pulsar/spec/blockers.tex

% Closed-finding registry. Mirror of BLOCKERS.md at the repository
% root; frozen at the submission tag. Every entry below is closed.

\section{Closed-finding registry}
\label{sec:blockers}

\noindent\textbf{Status: submission-ready. No open items.}

This appendix is the closure record. Every cryptographic finding
surfaced by the 4-red-agent + 1-scientist adversarial audit
(2026-05) is closed at \texttt{main}; each is filed against
specific files and lines in \texttt{BLOCKERS.md} at the repository
root.

\paragraph{Cryptographic findings closed against the audit.}
\begin{itemize}[leftmargin=*, itemsep=0pt]
\item \textbf{DKG commit-opening (CR-6).} Round-1 commit
$\mathrm{cSHAKE256}(c_i \| \mathit{blind}_i)$ is now bound to the
long-term identity public key and the DKG session identifier;
$(c_i, \mathit{blind}_i)$ are opened in the Round-2 reveal and the
digest is verified. Closed at v1.0.7 uniformly across the
$\GF(257)$ and $\GF(q)$ paths.
\item \textbf{Sign-round session-key derivation (CR-7).}
Each $(\textsf{sender}, \textsf{receiver}, \textsf{sid},
\textsf{transcript})$ quadruple derives a fresh $32$-byte session
key from an authenticated ML-KEM-768 $+$ HKDF stage. Closed at
v1.0.7; \texttt{legacyDeriveMACKeyLarge} is removed.
\item \textbf{DKG envelope confidentiality (CR-8).} Round-1
envelopes are KEM-wrapped (ML-KEM-768) and authenticated under
each recipient's long-term ML-DSA-65 identity public key. Closed
at v1.0.7.
\item \textbf{$\Sign$ Round-2 byte-equality (PULSAR-V03-1).} The
spurious post-sample forward-NTT on the public matrix $A$ in
\texttt{deriveKeyMaterial} is dropped: $A$ is sampled directly
into NTT representation per FIPS~204 \S3.5 Algorithm~32
(\texttt{ExpandA}). Closed at v1.0.20 (commit \texttt{023a3ed});
regression-guard hardening in v1.0.21 (\texttt{267ec04}) and
v1.0.22 (\texttt{29094a7}).
\item \textbf{Adaptive corruption proof.} Round-1 TS-UF is proved
under static corruption (the MPTC requirement); the adaptive-
corruption theorem ports the static reduction through the
chain-corruption simulator and is targeted for the v0.2 audit
cycle.
\item \textbf{Cross-domain isolation.} Pulsar (M-LWE) and Corona
(R-LWE) share the algebraic-lattice hardness substrate; a
deployment seeking lattice-family diversity composes them with a
hash-based (SLH-DSA) signer at the consensus envelope. Magnetar
is the Tier-3 research track for this composition.
\item \textbf{$\Verify$ constant-time.} \Cref{sec:verify} routes
verification through \texttt{cloudflare/circl}'s FIPS~204
verifier, which is documented constant-time. The
\texttt{ct/dudect/} harness pins the $10^9$-sample run in
\texttt{scripts/nightly.sh} and checks the results into
\texttt{ct/dudect/results/}; per-push gates run the same primitive
at $10^5$ samples.
\end{itemize}

\paragraph{Round-1 scope boundary.}
\begin{itemize}[leftmargin=*, itemsep=0pt]
\item Network model: Round-1 assumes synchronous broadcast within
the round window. Asynchronous identifiable abort routes through
a separate consensus-layer accountability artifact.
\item HSM-backed share custody: a deployment concern handled by
the operator hardening checklist in \texttt{docs/deployment.md}.
\item Physical side channels (power, EM, fault, cache timing):
handled at the deployed-binary layer; the algorithm-correctness
chain in the EasyCrypt refinement proof is unchanged.
\item Cross-message restart hybrid: the v0.2 wire shape ports the
restart semantics through the same MPTC submission framework.
\item Lattice estimator parameter pins: recorded in
\texttt{estimator/README.md}.
\end{itemize}

See \texttt{BLOCKERS.md} (repository root) for the canonical
closure record with specific file:line references and the per-
finding closure citation.