mirror-bond promotion rests on a single uncorroborated chain read — bring the Bonded verdict under NC-12 quorum

[MichaelTaylor3d]

Task

Mirror-bond promotion (bond_verify.rs / mirror_bond.rs, activated by PR #501) decides rank from a chain read that is single-source and uncorroborated: chain_source() asks coinset first and, on failure, ONE dialled chia peer whose own doc says "the peers do not corroborate the answer" (trustless: false). Nothing checks block inclusion. A peer in the chia peer set can therefore return a self-consistent fabricated coin that declares its own peer id and take rank 0 at zero collateral. Bring this read under NC-12: agreement across the ~5 concurrently-held untrusted chia peers (or coinset + at least one independent peer agreeing on coin id, puzzle hash, amount, spent state and confirmed height) before a verdict of Bonded is produced; disagreement or insufficient sources → Unverified, never Bonded.

Context

• Finding 2 (MEDIUM, non-gating) of the loop-security audit on PR feat(mirror): activate bond promotion on the coin's own peer declaration #501 at 59a0331: feat(mirror): activate bond promotion on the coin's own peer declaration #501 (comment)
• Posture is inherited from the wallet's chain_source() (crates/dig-wallet/src/sage/chain.rs), which the light client already corroborates for sync-status (NC-12 in .claude/skills/normative-contract). Reuse that quorum path (quorum.rs) rather than building a second one — §2.0 centralize rivals.
• PR feat(mirror): activate bond promotion on the coin's own peer declaration #501 adds one sentence to SPEC.md §25.6a naming the assumption; this ticket removes the assumption.
• Parent epic (orchestrator): https://github.com/DIG-Network/dig_ecosystem/issues/3166
• Siblings: Nothing verifies a mirror-coin claim against chain — the collateral economy is unenforced #466 (chain verification of a mirror-coin claim), Nothing binds a mirror coin's owner to a DHT peer id — verification cannot name a claimant #473 (coin ↔ peer binding), feat(mirror): activate bond promotion on the coin's own peer declaration #501

Effort

High — custody-adjacent decision, quorum semantics, failure direction matters (fails-closed to Unverified).

Scope

Only the verdict path that produces Bonded. Do not widen to the census or spends unless they share the exact helper.

Evidence

A test with a chain-source double where one of N sources returns a fabricated coin and the others do not → verdict Unverified; and where all agree → Bonded. Cite the test names and the SPEC §25.6a change in the PR.

Priority

High (money path). kind:business — a fabricated coin taking rank 0 moves $DIG to the wrong party.

[MichaelTaylor3d]

Lane opened. Branch loop/503-bond-quorum, draft PR #506 (Closes #503 verified to parse), version 0.251.0 (0.248/0.249/0.250 are claimed by open PRs #499/#500/#498).

Determination: this is the CORROBORATION case, and the reason is that no proof is reachable

The ticket asks for quorum. Before designing one I checked whether verification would beat it, because a single-source read of a value the chain commits to is not automatically wrong. It would have been the cheaper answer. It is not available:

• ChainSource (dig-chainsource-interface/src/source.rs) exposes no block header, no merkle path, no inclusion proof. Its only proof-shaped primitive is resolve_singleton_lineage, and a mirror coin is a CAT, not a singleton — it has no launcher to walk from. The alternative anchor, walking the CAT lineage to a real terminus, is unbounded and still needs a trusted anchor.
• The self-verifying half already holds and needs no quorum: MirrorCoin::from_creating_spend(spend, coin_id) derives puzzle hash, amount, asset id and advertised terms from executed on-chain code bound to the claimed coin id, and the spend's puzzle reveal tree-hashes to its coin's puzzle hash. A lying source cannot change what coin C is.
• What none of that establishes is that C exists on mainnet. Every step is internal consistency, never chain membership. An attacker curries the real, public $DIG CAT puzzle around an invented parent, computes the child id, and publishes it — the fabricated lineage passes all four steps.

So corroboration is the only handle. It is also cheap, precisely because of the self-verifying half: the whole verdict reduces to exactly two primitive reads, coin_record(C) and coin_spend(C.parent_coin_info).

Reuse, not a second quorum

dig-wallet's sage::peer_reads::PeerCorroboratedReads already corroborates exactly those two reads over the node's own concurrently-held peers, inheriting sage::quorum's CORROBORATION_FLOOR (=2, never one source) and required_agreement, and already fails closed — Err is UNKNOWN, never absence. The defect is that bond_verify reads through the wrong source: ChainTransport::chain_source() hands back chia-query's router, which asks api.coinset.org first and whose own ProviderInfo says trustless: false.

On independence — sage::sources::independence_group_for already encodes the answer: a fabric with coinset_fallback_enabled is the oracle's group however many peers it holds. That is why N reads through the router are one read wearing a hat, and why the fix must draw on DialedPeerSample and must never fall back to the router (that would let one endpoint overrule the peers exactly when they failed to agree).

Shape: a CorroboratedChainSource adapter in dig-wallet + ChainTransport::corroborated_chain_source() (errs rather than falling back) + ChainBondVerifier reading through it. The production transport is already built .with_peer_reads(db) (sage/service.rs:183) and server.rs:2179 hands that same Arc to spawn_bond_verifier_install, so the path is reachable in production.

Relation to #501 — orthogonal, not the same mechanism

They ask different questions and neither subsumes the other:

• feat(mirror): activate bond promotion on the coin's own peer declaration #501 asks whose bond — does this coin declare this peer? Answered by executed on-chain code; self-verifying given the coin.
• **mirror-bond promotion rests on a single uncorroborated chain read — bring the Bonded verdict under NC-12 quorum #503 asks whether the bond exists ** — is the coin on mainnet at all? Not self-verifying by any means available.

They compose as two independent gates on one verdict. Worth recording: #503's defect is only live once #501 merges — until then declaration_source_is_readable() short-circuits, no chain read is paid, and no Bonded is reachable. Both edit bond_verify.rs, so whichever lands second merges main in.

Tests therefore target the chain half (chain_bond_verdict), not verdict_for, which the short-circuit makes unreachable on main today. The suite carries an explicit anti-vacuity control — all peers agreeing on a genuine coin MUST yield Bonded — because without it the suite would pass by never producing Bonded at all.

Out of scope, deliberately

The collateral census also reads chain_source() and stays untouched, per this ticket's Scope clause. chain.rs's peak_height doc already records that as a tracked sequencing constraint against the mirror-coin mint; corroborated_chain_source() makes fixing it a one-liner when it is selected.

Gates (reviewer + security + adversarial refutation) run after the implementer returns. Not merging, not undrafting.