zeekay 46f121a827 fix(OnlyStrictPQ): allow-list strict-PQ gate, refuse zero verifier ...

Flip `_refuseUnderStrictPQ` from deny-list to allow-list semantics.
Under `PROFILE_QUASAR_STRICT_PQ`, a verifier is admissible iff its
`policyId()` is in `{POLICY_STARK_FRI_SHA3_PQ, POLICY_MLDSA65_FIPS204}`.
A spoofed verifier returning an unknown bytes32 from `policyId()` (not
classical, not PQ) is now refused — the previous deny-list let any
unrecognised value pass.

Replace the early-return-on-zero-address branch with an explicit
revert (`VerifierUnsetUnderStrictPQ`) under strict-PQ. A zero
verifier under strict-PQ is a silent no-op state and was exactly the
attack vector Red flagged: admin + setActiveProfile(STRICT_PQ, 0)
disabled the gate while keeping the profile bytes32 set. Now refused.
Classical-compat still allows address(0) — that profile's gate is a
no-op by design.

Adds three tests:
  - testStrictPQ_RefusesZeroAddress
  - testClassicalCompat_AllowsZeroAddress
  - testStrictPQ_RefusesSpoofedPolicy
Removes the obsolete testUnconfiguredSlot_IsNoOp (asserted old behaviour).
Forge: 14 passed / 14 total.

Closes Red HIGH cluster #2/#5/#8 at the foundation layer.
Version: 0.1.0 → 0.1.1.

2026-05-13 16:08:24 -07:00

..

PQProfileIDs.t.sol

fix(OnlyStrictPQ): allow-list strict-PQ gate, refuse zero verifier

2026-05-13 16:08:24 -07:00