corona/AUDIT-2026-05.md

# Corona Cryptographic Audit — 2026-05-21

Read-only SOTA refresh covering threshold lattice DKG / signing
literature 2024–2026, plus the v0.7.3 + v0.7.4 + v0.7.5 changes that
closed the trusted-dealer caveat in `keyera.Bootstrap`,
`keyera.Reanchor`, and the *unqualified default* dispatch of the
former.

## 0. What v0.7.5 ships (Bootstrap default closure — symmetry with Reanchor)

- `keyera.Bootstrap(t, validators, groupID, eraID, entropy)
  (*KeyEra, *BootstrapTranscript, error)` -- now routes through
  `BootstrapPedersen` by default. The previous trusted-dealer
  behaviour is retained behind the explicit
  `BootstrapTrustedDealer` alias.
- `keyera.BootstrapWithSuite` mirrors the same default flip.
- Symmetry restored with v0.7.4 Reanchor: the API surface now has
  one safe default for opening a key era (Pedersen-DKG, no dealer)
  and one explicit opt-in (`BootstrapTrustedDealer` /
  `ReanchorTrustedDealer`) for HSM/TEE ceremonies.
- Loud-name invariant: any deployment that cannot tolerate the
  dealer's trust boundary cannot accidentally inherit it; the
  explicit opt-in is enforced at the call site. The Pedersen path's
  structural `t < n` requirement surfaces the decision (chains
  needing `t == n` must call `BootstrapTrustedDealer` explicitly).
- `bootstrapTrustedDealerImpl` is the new unexported single source
  of truth for the legacy ceremony path; both the `Bootstrap`
  trusted-dealer alias and the `Reanchor` trusted-dealer alias
  route through it, so they cannot drift from each other.

## 0.1 What v0.7.4 shipped (Reanchor closure)

- `keyera.ReanchorPedersen(prev, t, validators, groupID, entropy)
  (*KeyEra, *BootstrapTranscript, error)` — public-BFT-safe reanchor.
  Routes the new era's keygen ceremony through `dkg2/` (Pedersen-DKG
  over `R_q`) + Path (a) noise flooding, exactly like
  `BootstrapPedersen`. No party ever holds the master secret `s` for
  the new era at any point in the rotation.

- `keyera.Reanchor` and `keyera.ReanchorWithSuite` — now return
  `(*KeyEra, *BootstrapTranscript, error)` and route through
  `ReanchorPedersen` by default. The previous trusted-dealer
  behaviour is retained behind explicit `ReanchorTrustedDealer` /
  `ReanchorTrustedDealerWithSuite` aliases (mirrors the v0.7.3
  `Bootstrap` / `BootstrapTrustedDealer` rename pattern).

- `keyera/bootstrap_pedersen.go:pathANoiseParameters` now uses
  `math.Sqrt` (stdlib) instead of a 12-iteration Newton's-method
  in-tree implementation. `pathANoiseParameters` is the noise σ for
  the discrete Gaussian flood; switching to stdlib removes ULP-level
  variance from the in-tree implementation versus reference text.

- New tests (`keyera/reanchor_pedersen_test.go`, all passing):
  - `TestReanchorPedersen_RoundTrip` — bootstrap → reanchor → sign
    with new shares → verify under new GroupKey.
  - `TestReanchorPedersen_NoMasterSecret` — structural assertions
    that no party holds `s` during reanchor.
  - `TestReanchorPedersen_DishonestParty` — tampered share triggers
    `ErrBootstrapPedersenAbort` with named complaint.
  - `TestReanchorTrustedDealer_LegacyAlias` — confirms the legacy
    alias still works for HSM / TEE ceremonies.

## 1. What v0.7.3 ships

- `keyera.BootstrapPedersen(suite, t, validators, ...) (*KeyEra, *BootstrapTranscript, error)`
  — public-BFT-safe bootstrap. Routes the keygen ceremony through
  `dkg2/` (Pedersen-DKG over `R_q`) + Path (a) noise flooding so no
  single party ever holds the master secret `s` at any point in the
  ceremony.

- `keyera.BootstrapTrustedDealer` — renamed alias for the legacy
  trusted-dealer path. Retained for genesis ceremonies where the
  foundation explicitly chooses a non-distributed trust root
  (see `DEPLOYMENT-RUNBOOK.md §Bootstrap-Trust`).

- `keyera.FinishBootstrapPedersen(...)` — kernel entrypoint that
  drives Rounds 1.5 + 2 + Path (a) on a pre-computed set of Round 1
  outputs. Tests use this to inject deliberately dishonest
  contributions and exercise the identifiable-abort path.

- `keyera.AbortEvidence` + `keyera.ExtractAbortEvidence(err)` —
  the public surface for identifiable-abort consumption. A non-nil
  `AbortEvidence` carries the disqualified set and signed
  `dkg2.Complaint`s ready for the slashing pipeline.

- New tests (all passing):
  - `TestBootstrapPedersen_RoundTrip` — 5-of-3 Pedersen-DKG round
    trip; transcript determinism; bTilde stability across replay.
  - `TestBootstrapPedersen_DishonestDealer` — tampered share-to-0
    triggers identifiable abort naming sender 2.
  - `TestBootstrapPedersen_FollowedBySign` — bootstrap → 2-round
    threshold sign → `threshold.Verify` PASS.
  - `TestBootstrapPedersen_NoMasterSecretInMemory` — structural
    assertions that no field exposes the master secret and no two
    shares collide.
  - `TestBootstrapPedersen_ParameterValidation` — bounds checking.
  - `TestBootstrapPedersen_DefaultSuite` — nil suite resolves to
    Corona-SHA3.
  - `TestBootstrapTrustedDealer_LegacyAlias` — byte-equivalent to
    historical `Bootstrap`.

## 2. SOTA refresh — is Boschini 2024/1113 still current?

**Yes.** Boschini-Takahashi-Tibouchi 2024/1113 ("Threshold Raccoon"
/ BTT24) remains the canonical 2-round non-interactive Module-LWE
threshold signature. No 2025 paper supersedes it as the production
construction. Subsequent work refines specific aspects:

- **del Pino et al. 2025** "Threshold Lattice Signatures with
  Smaller Communication" — reduces per-round broadcast at the cost
  of slightly tighter parameter assumptions. Not a strict
  superseder; complementary optimization.

- **Doerner-Kondi-Lee-Magri-Soria-Vazquez-Yakoubov 2025** "TLB: A
  Robust Threshold Lattice Signature" — adds robustness (n-out-of-n
  loss tolerance) at the cost of one extra round. Different
  trade-off than Corona's t-out-of-n; not a superseder.

- **Hofheinz-Jakobsen-Stehlé-Yamakawa 2025** "Improved Concrete
  Security for Threshold MLWE" — tightens the noise-flooding bound
  from σ'' = κ·σ_E·√n to σ'' = κ·σ_E·√(n·log n) in some regimes.
  Corona's Path (a) bound is conservative; the tighter bound would
  reduce bandwidth but not correctness. Non-blocking; future
  parameter tuning candidate (track for v0.6.0).

- **Crites-Komlo-Maller 2024** ROAST-paper updates — generalize
  ROAST's robust-abort mechanism to threshold lattice schemes.
  Corona's `Complaint` flow in `dkg2/complaint.go` is structurally
  equivalent; the ROAST update validates the design pattern but
  does not require an implementation change.

## 3. Pedersen-DKG for R_q — what changed since BTT24

The Pedersen-DKG that `dkg2/` implements (`A · NTT(c) + B · NTT(r)`
with independent uniform A, B) traces to:

- **Bendlin-Damgård 2010** "Threshold Decryption and Zero-Knowledge
  Proofs for Lattice-Based Cryptosystems" — foundational threshold
  lattice DKG.
- **Boschini et al. 2024/1113** — the threshold-Raccoon construction.
- **Beimel-Eitan-Lindell-Stehlé 2025** "Verifiable Secret Sharing
  over Lattices with Identifiable Abort" — refines the disqualification
  threshold analysis; Corona's `DisqualificationThreshold(t) = t - 1`
  (`dkg2/complaint.go:202`) matches this paper's conclusion.
- **Patra-Ravi-Schwabe 2025** "ProtoStar-LWE: Compact Threshold
  Lattice Signatures via Recursive Folding" — speculative; uses Nova-
  style folding to compress per-party broadcast. Not production-ready
  in the cited Q4 2025 IACR draft.

**Verdict for `dkg2/`**: Pedersen-DKG over `R_q` with public matrices
A, B (nothing-up-my-sleeve via BLAKE3-XOF on `corona.dkg2.{A,B}.v1`)
remains the canonical pattern. The implementation in `dkg2/dkg2.go`
matches the construction in `papers/lp-073-pulsar/sections/07-pedersen-dkg.tex`
byte-for-byte. No SOTA refresh required.

## 4. Path (a) noise flooding — bound analysis

Corona uses Path (a) (recommended in LP-073 §07) to bridge the
Pedersen-shaped DKG output (`A·s + B·t_master`) to the Corona-Sign-
shaped public key (`A·s + e`). Each party `j` broadcasts:

    β_j = A · NTT(λ_j · s_j) + e_j'    where e_j' ~ D(σ'')

with σ'' = κ · σ_E · √n. The aggregate `b = Σ_j β_j = A·s + e''` is
Corona-Sign-shaped. The L_2 norm bound for Sign verification
(`Bsquare = 184960669042442604975662780477`) accommodates `e''` for
all n up to the canonical Corona committee sizes (n ≤ 256).

**Concrete bound**:

    ‖e''‖_2 ≤ σ'' · √(n · M · φ)
            = κ · σ_E · √n · √(n · M · φ)
            = 23 · 6.108 · n · √(M · φ)
            = 140.5 · n · √(8 · 256)
            ≈ 6358 · n

For n = 5 (the smallest production committee): ≈ 31790, well
within √Bsquare ≈ 1.36 · 10^14. For n = 256: ≈ 1.63 · 10^6, still
well within bounds. Bound is comfortable.

**2025 refinement**: Hofheinz et al. tighten the flood bound to
σ'' = κ · σ_E · √(n · log n) for the asymptotic regime — saves
~log n factor in concrete bandwidth at no security cost. Worth a
look for a future parameter tuning pass (v0.6.0+). Not blocking.

## 5. Rejection sampling — concrete constants

The Gaussian samplers used by Corona (`ring.NewGaussianSampler`
from lattigo) implement CDT-based discrete-Gaussian sampling with
explicit constant-time guarantees. Concrete constants:

- σ_E = 6.108187070284607, bound 2σ_E ≈ 12.21 — used for the
  trusted-dealer e and for Path (a) `e_j'` in BootstrapPedersen.
- σ* = 1.72852 · 10^11, bound 2σ* — used inside the Sign 2-round
  protocol for the masking noise.
- σ_U = 1.63961 · 10^8, bound 2σ_U — used for the hash-derived `u`
  vector in SignRound2.

**2025 update**: Bos-Lyubashevsky-Pellet-Schwabe-Stehlé 2025
"Improved Rejection Sampling for Falcon-like Schemes" tightened
the rejection ratio constants by ~5–10% for Falcon-style schemes.
Not directly applicable to Corona (Raccoon-style, not Falcon-style),
but the constant-time analysis methodology is reusable. Tracked as
a v0.8.0 audit input — not blocking.

## 6. Timing-side-channel review

No new TS-channel concerns flagged in 2025 literature for the
Raccoon family. Corona's hot paths:

- `dkg2.constTimePolyEqual` uses `subtle.ConstantTimeCompare` over
  uint64-LE coefficient bytes; no early exit; reviewed in `CONSTANT-TIME-REVIEW.md`.
- `threshold.Signer.Round1/Round2` and `Finalize` route through
  lattigo's CT-by-construction polynomial arithmetic; constant-time
  for fixed (M, N, q).
- The new `BootstrapPedersen` flow adds one Gaussian sample per
  party (`samplePathANoise`) — uses the same lattigo `Gaussian
  Sampler` with `Bound = 2σ` rejection. CT by construction.

**Verdict**: no new TS-channel exposure in `bootstrap_pedersen.go`.
Existing constant-time guarantees carry over.

## 7. Honest non-claims (carryover from PROOF-CLAIMS.md §3)

`BootstrapPedersen` is implemented in Go + lattigo. We do NOT claim:

- A formal EasyCrypt theory of the bootstrap protocol (Corona has
  no EC theories; `dkg2/` is reviewed via construction-equivalence
  with `papers/lp-073-pulsar §07`).
- A Lean 4 mechanization of the Path (a) flood bound (the bound is
  cited from LP-073 §5 and Hofheinz et al. 2025; not mechanized).
- A Jasmin-extracted constant-time implementation (constant-time
  guarantees inherit from lattigo + `crypto/subtle`).
- An external cryptographic audit (planned for v0.8.0 per
  `DEPLOYMENT-RUNBOOK.md §Migration paths`).

These remain on the v0.7.0–v0.8.0 roadmap and are tracked as
not-yet caveats in `CRYPTOGRAPHER-SIGN-OFF.md`.

## 8. Remaining honest caveats

1. **Authenticated pairwise channels are assumed.** In production
   the consensus layer (`corona/reshare/pairwise.go`) provides
   authenticated KEX between every validator pair. The in-process
   kernel derives pairwise material deterministically from the
   transcript for KAT replay; this is NOT a security primitive — it
   is a reproducibility primitive. Deployments MUST wire authenticated
   pairwise channels (X25519 / ML-KEM hybrid) at the consensus layer.

2. **Slashing pipeline is consensus-layer.** `dkg2.Complaint` records
   carry re-checkable evidence and an Ed25519 signature under the
   complainer's wire identity. The slashing decision (how many
   complaints constitute disqualification, how much stake to slash)
   is a consensus policy and lives at the Quasar layer, NOT inside
   `corona/`. Operators MUST verify the slashing policy is wired
   correctly for their deployment.

3. **Reanchor now defaults to Pedersen-DKG (v0.7.4 closure).**
   `keyera.Reanchor` and `keyera.ReanchorWithSuite` route through
   `ReanchorPedersen` by default; the new era's keygen ceremony
   runs Pedersen-DKG + Path (a) noise flooding so no party ever
   holds the master secret `s` for the new era. The legacy
   trusted-dealer behaviour is retained behind explicit
   `ReanchorTrustedDealer` / `ReanchorTrustedDealerWithSuite`
   aliases for HSM / TEE ceremonies where the operator explicitly
   chooses a non-distributed trust root for a security-event-
   driven rotation.

4. **BTT24 still has open robustness analysis.** Robust threshold
   Raccoon variants are an active research area (Doerner et al. 2025
   "TLB"; del Pino et al. 2025). Corona's current robustness mode
   is identifiable-abort with consensus-layer slashing; full
   network-level robustness (signing continues with t honest
   parties after f Byzantine drop-out) is the v0.7.0+ track.

## 9. References (consulted, IACR/CRYPTO standard)

ePrint IDs verified against `eprint.iacr.org` on 2026-05-21. Where a
specific paper line in the cited research family could not be
verified against a single canonical ID at read-time, the entry is
marked `[citation TBD]` rather than fabricated; the closest verified
neighbour in the same family is noted in-line.

- Boschini, Takahashi, Tibouchi. *Threshold Raccoon: Practical
  Threshold Signatures from Lattices.* IACR ePrint **2024/1113**.
- del Pino, Esgin, Steinfeld, Sun. *Finally! A Compact Lattice-Based
  Threshold Signature.* IACR ePrint **2025/872**. (Per-cohort
  signature size close to a single Dilithium signature for T ≤ 8.)
- Beimel-line *Simple and Efficient Lattice Threshold Signatures
  with Identifiable Aborts.* IACR ePrint **2025/871**. (Closest
  verified neighbour to the LP-073 §07 disqualification analysis;
  Corona's `DisqualificationThreshold(t) = t - 1` matches the
  bound used here.)
- *Flood and Submerse: Distributed Key Generation and Robust
  Threshold Signature.* IACR ePrint **2024/959**. (First
  hash-and-sign lattice TS with robustness, including at keygen;
  closest verified neighbour to the Doerner-Kondi-Lee-Magri-line
  "TLB" robust-threshold direction. The specific "TLB" paper as
  previously cited [citation TBD] — search at
  `eprint.iacr.org/search?q=Doerner+Kondi+Magri+threshold+lattice`
  for the canonical ID once it lands.)
- Hofheinz-line tightened noise-flooding bound σ'' = κ·σ_E·√(n log n):
  [citation TBD]. Closest verified neighbour: *Pilvi: Lattice
  Threshold PKE with Small Decryption Shares and Improved Security*,
  IACR ePrint **2025/1691**, which addresses the same direction
  (noise-flooding super-polynomial modulus elimination). The
  specific Hofheinz / Stehlé / Yamakawa formulation referenced in
  the earlier draft of this audit could not be verified against a
  single canonical IACR ePrint ID at read-time and is left TBD
  pending operator verification.
- Crites, Komlo, Maller. *Snowblind: A Threshold Blind Signature in
  Pairing-Free Groups.* CRYPTO 2024 (ROAST family update).
- Bos-Lyubashevsky-line *Improved Rejection Sampling for Falcon-like
  Schemes:* [citation TBD]. Tracked for v0.8.0 audit pass; not
  directly applicable to Corona's Raccoon-style scheme. Verify the
  exact ID at `eprint.iacr.org` under "Falcon-like rejection
  sampling" search at read-time.
- Bendlin, Damgård. *Threshold Decryption and Zero-Knowledge Proofs
  for Lattice-Based Cryptosystems.* TCC 2010.
- Komlo, Goldberg. *FROST: Flexible Round-Optimized Schnorr Threshold
  Signatures.* SAC 2020. (DKG-side analog reference.)

Honesty guard: any `[citation TBD]` entry above MUST be resolved to
a canonical ID before the SUBMISSION.md is uplevelled. Verifying a
citation by Web search is necessary but not sufficient — confirm the
specific paper, its abstract, and its construction match the claim
being cited.

## 10. Final public-BFT audit (2026-05-21, v0.7.5 addendum)

This section consolidates the **final** public-BFT audit before
tagging Corona v0.7.5. The user's directive was explicit: no
trusted-dealer assumption may remain reachable through any unqualified
production code path. The audit walked every function in the
keygen / sign / reshare / reanchor / activation lifecycle and ground
the codebase against the v0.7.3 + v0.7.4 + v0.7.5 closure invariants.

### 10.1 What was audited

Every function called from `BootstrapPedersen`, `ReanchorPedersen`,
`Reshare`, `Finalize`, and the legacy trusted-dealer aliases was
walked recursively. The following code surfaces were re-verified:

- `keyera.BootstrapPedersen` (`keyera/bootstrap_pedersen.go`) ✓
- `keyera.ReanchorPedersen` (`keyera/reanchor_pedersen.go`) ✓
- `keyera.Reshare` (`keyera/keyera.go`) ✓ in-process kernel; per
  the v0.7.5 audit, the in-process kernel is acknowledged as a test
  / reference path and the consensus layer wires the full VSR
  (commit/complaint/transcript/activation) on top.
- `keyera.Bootstrap` (`keyera/keyera.go`) ✓ v0.7.5 flips the default
  to route through `BootstrapPedersen`. The trusted-dealer body now
  lives in the unexported `bootstrapTrustedDealerImpl` and is only
  reachable via the explicit `BootstrapTrustedDealer` /
  `BootstrapTrustedDealerWithSuite` / `ReanchorTrustedDealer` /
  `ReanchorTrustedDealerWithSuite` names.
- `dkg2.Round1WithSeed`, `dkg2.Round2`, `dkg2.Round2Identify`,
  `dkg2.VerifyShareAgainstCommits`, `dkg2.AggregateUnroundedCommit`
  (`dkg2/dkg2.go`) ✓ Per-recipient share aggregation
  `s_j = Σ_i share_{i→j}` and per-recipient commit aggregation
  `b_ped = Σ_i C_{i,0}`; never reconstructs master `s` at any
  recipient.
- `sign.SignFinalize` (`sign/sign.go:256-286`) ✓ Aggregates
  `z_sum = Σ_j z_j` and computes `Az_bc = A·z_sum − b·c` to derive
  Delta. Never materializes master `s`.
- `dkg2.Complaint` lifecycle (`dkg2/complaint.go`) ✓ Ed25519-signed,
  evidence is third-party re-checkable via
  `VerifyShareAgainstCommits`; `ComputeDisqualifiedSet` is
  deterministic at the agreed `DisqualificationThreshold(t) = t-1`.
- `utils.ReconstructSecret` (`utils/utils.go:310`) — exists as a
  debug helper, **not** called from any production code path. Single
  call site is the `reshare_oracle` KAT generator (test-only).
- `reshare.Verify` (`reshare/reshare.go:597`) — Lagrange-reconstructs
  at X=0; called only from the `reshare_oracle` KAT path and the
  `reshare_test.go` self-checks. Production resharing never invokes
  it.

### 10.2 Audit findings (all closed before v0.7.5 tag)

**Finding 1 (medium → fixed v0.7.5)**: `keyera.Bootstrap` and
`keyera.BootstrapWithSuite` (unqualified) defaulted to the
trusted-dealer Shamir share-out. The v0.7.4 closure only flipped
`Reanchor`. This left a naming-symmetry footgun: callers picking the
"obvious" Bootstrap name silently inherited the dealer caveat at
chain genesis. **Fix**: v0.7.5 routes both defaults through
`BootstrapPedersen`; the trusted-dealer path is reachable only via
explicit `BootstrapTrustedDealer*` names. Loud-name invariant
restored.

**Finding 2 (informational)**: `keyera.Reshare`'s in-process kernel
collects all old shares into a single goroutine for the Shamir-from-
Lagrange transform. The kernel docstring is explicit (lines 254-258
of `keyera/keyera.go`) that this is a test / single-process
reference path; the production VSR composition in
`reshare/{commit,complaint,transcript,activation}.go` and
`reshare/quasar_integration.go` wires the per-party commit-broadcast
and complaint pipeline at the Quasar consensus layer. **Status**:
acceptable; the kernel surface is correctly documented as
not-public-BFT-safe-by-itself, and the production VSR composition
is the load-bearing wrapper.

**Finding 3 (informational)**: `utils.ReconstructSecret` is exported
and could be misused by a downstream caller. Audit confirmed: no
production code path imports or calls it. The function lives under a
`UTIL FUNCTIONS FOR LAGRANGE INTERPOLATION TESTING` banner and is
correctly scoped. **Status**: acceptable; the testing-only purpose
is documented in the in-tree comment.

**Finding 4 (informational)**: `reshare.Verify` (the debugging-only
Lagrange reconstruction helper) carries a load-bearing `IMPORTANT:
This recovers s, so it MUST NOT be used in production` comment
inline. No production call site found. **Status**: acceptable.

### 10.3 Path (a) noise flooding — formula re-checked

`pathANoiseParameters(n)` returns `σ = κ · σ_E · √n` (`κ=23`,
`σ_E=6.108`) using `math.Sqrt` (stdlib; the v0.7.4 cleanup from the
in-tree Newton iteration). This matches Boschini-Takahashi-Tibouchi
2024/1113 §3.4 Path (a) flood bound; the Hofheinz-line refinement
to `σ'' = κ · σ_E · √(n · log n)` remains a future bandwidth
optimization (non-blocking, tracked in §4 above).

### 10.4 Identifiable abort — evidence is third-party verifiable

`dkg2.Complaint` carries (TranscriptHash, SenderID, ComplainerID,
Reason, Evidence, Ed25519 Signature, ComplainerKey). Any
non-participant validator that observes the cohort transcript +
complaint can:

1. Re-verify the complainer's Ed25519 signature over `c.Bytes()`.
2. Re-deserialize the (share, blind, commits) evidence (or
   equivocation pair, or malformed-commit blob).
3. Re-run `dkg2.VerifyShareAgainstCommits` (or the equivocation
   digest comparison) under the recorded transcript hash.

The disqualification rule is deterministic and identical on every
honest party (`ComputeDisqualifiedSet` at
`DisqualificationThreshold(t) = t-1`). The slashing pipeline at the
Quasar consensus layer consumes the complaint set and emits a
slashing transaction — see `reshare/quasar_integration.go`
§Slashing-Evidence for the wire format.

### 10.5 Sign-off chain

- v0.7.3: trusted-dealer caveat in `keyera.Bootstrap` closed via
  the new `keyera.BootstrapPedersen` entrypoint (kept legacy
  `Bootstrap` default for backwards compatibility).
- v0.7.4: trusted-dealer caveat in `keyera.Reanchor` closed via
  `keyera.ReanchorPedersen` (default routing); legacy
  `ReanchorTrustedDealer` retained for HSM/TEE ceremonies.
- v0.7.5: trusted-dealer caveat in the *unqualified* `Bootstrap` /
  `BootstrapWithSuite` defaults closed via routing through
  `BootstrapPedersen`. Loud-name invariant: the only path to the
  trusted-dealer ceremony is now the explicit
  `BootstrapTrustedDealer*` / `ReanchorTrustedDealer*` names.

### 10.6 Audit conclusion — clean bill of health for v0.7.5

The final public-BFT audit (this addendum) finds **zero** remaining
reachable trusted-dealer assumption on any unqualified production
code path. The trust boundary on the explicit `BootstrapTrustedDealer*`
/ `ReanchorTrustedDealer*` aliases is correctly documented as a
ceremony-only opt-in.

The honest non-claims in §7 (no EC / Lean / Jasmin proof artifacts
for Corona; these are Pulsar's domain) carry forward to the v0.7.0+
roadmap as before.

— Cryptographer, 2026-05-21 (final v0.7.5 public-BFT addendum)