Each family whose corpus lacked them gets the three signatures a verifier that
checks only the equation accepts and WAI's rule refuses (wai_sig::forgeries):
the identity as the key with (R, S) = (B, 1), the identity spelled y = p + 1,
and R of small order under the base point. Every case is new; no existing
vector's expectation changes.
- jwp: group_signer_key_identity_forged, group_signer_key_identity_y_not_reduced
(step 1, bad_signer_key), group_signature_r_small_order (step 2).
- signer: anchor_root_identity_forged, anchor_root_identity_y_not_reduced,
anchor_root_signature_r_small_order (not anchored, key_log_signature_invalid).
- pack: mutations receipt-key-identity, receipt-key-identity-y-not-reduced,
receipt-r-small-order (receipt-signature); receipts/ v1-key-identity,
v1-key-identity-y-not-reduced, v1-r-small-order, marked "signature": "refused",
which wai-pack and pack_verify.py now read.
- quantum-ops: cal_q3_ and job_bell_ key_identity, key_identity_y_not_reduced and
r_small_order, "verifies": false, which wai_quantum_ops_vectors checks are
refused and hash as pinned.
claim (signer_key_identity, signer_key_identity_y_not_reduced,
signature_r_small_order and others) and http (sig-key-identity, -long,
sig-r-small-order) had them already. OER/2 keeps its own rule.
PackageReceipt::signing_payload (v1) and the calibration and job receipts'
signing_payload are public, so a corpus generator can sign over them;
wai-quantum re-exports wai_sig beside ed25519_dalek.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
9b5854aa4c