zeekayandHanzo Dev eaab7eeda3 token: compare the mac, not the label, when checking domain separation ...

The test asserted that two domains mint different tokens, which the domain prefix
guarantees on its own — so it passed with the per-domain key derivation removed
and one key minting every domain. It now compares the mac behind the prefix,
which is the thing the key schedule is responsible for.

Found by mutating the HKDF info to a constant: the mutant survived, which is the
only way to learn that a test passes for the wrong reason.

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-29 11:14:53 -07:00

..

token_test.go

token: compare the mac, not the label, when checking domain separation

2026-07-29 11:14:53 -07:00

token.go

aml: anomaly scoring, retention, tokenisation, replay, reference data

2026-07-29 11:04:33 -07:00