# enrolled-signature-key-review

> Review unknown persistent Schnorr keys without modeled identity rejection.

Canonical: https://nightshade.dicksonwu.xyz/rules/enrolled-signature-key-review.html
Release: Nightshade 0.1.1 (v0.1.1)

| Field | Value |
| --- | --- |
| Rule ID | `enrolled-signature-key-review` |
| Severity | info |
| Confidence | varies |
| Maturity | experimental |
| Selection | Opt-in |
| Policy intent | not required |
| Default enabled | no |
| Category | Other active opt-ins / Authorization, identity and membership |
| Engine facts used | successful-signature-calls, all-predicates, original-write-history |
| Release | v0.1.1 |

## Selection and scope

Not selected by default. Select it with `--detectors` or the `detectors` list in nightshade.json. Either one replaces profile selection, so list every rule you want.

```sh
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors enrolled-signature-key-review
./.nightshade/node_modules/.bin/nightshade detector show enrolled-signature-key-review
```

The first command runs only this rule; `--detectors` takes a comma-separated list. The second prints the rule's metadata from your installed version.

Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.

Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.

## Corpus checks

Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.

| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
| ---: | ---: | ---: | ---: | ---: |
| 1/1 | 1/1 | 1/1 | 0/0 | 0 |

No deviations were recorded for this rule.

These are behavior checks on synthetic fixtures, not a precision or recall estimate. See [evaluation](https://nightshade.dicksonwu.xyz/evaluation.md#synthetic-corpus).

## Rule documentation

From https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/enrolled-signature-key-review.md at v0.1.1.

Availability: **opt-in**; informational severity, medium confidence. No policy required.

Review an unknown entry-storage snapshot from a whole persistent JubjubPoint Cell
passed to the canonical pinned `jubjubSchnorrVerify`, when no modeled mandatory
check on that exact successful history excludes the identity point. Enrollment
validation in another transaction, trusted initialization or application policy
may make this intentional. The rule does not establish unsafe enrollment, a
known identity key, signature enforcement, sole authorization or exploitability.

Ordinary aliases, helper arguments and retained snapshots preserve immutable
identity. Guards on another key or a new storage revision do not protect an old
snapshot. Mandatory equality constraints and both branch polarities stay within
their original history; checks from mutually exclusive histories are not joined.
An enforced `ecMul(key, scalar) != default<JubjubPoint>` or `ecNeg(key) !=
default<JubjubPoint>` excludes identity of that exact key because the pinned
native operations map identity to identity. This inference says nothing about
subgroup membership, curve membership or off-curve inputs.

The pinned 0.35.0 and 0.35.0-rc.1 canonical verifiers reject identity internally;
their successful calls are quiet. Direct caller or witness keys, transformed
point keys, projected struct fields, collection values, same-named application
circuits and known identity keys are outside this review. The existing
`identity-signature-key` detector continues reporting its known identity evidence.
Source unknowns and exhausted allowances produce explicit incomplete diagnostics.

## Suppress a match

If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:

```compact
// nightshade-disable-next-line enrolled-signature-key-review -- Reason this match is intentional
```

Diagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See [configuration](https://nightshade.dicksonwu.xyz/configuration.md#suppress-an-intentional-match) for fingerprint suppressions and baselines.

## References

- [Rule source document at v0.1.1](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/enrolled-signature-key-review.md)
- [Catalog entry in rules.json](https://nightshade.dicksonwu.xyz/rules.json)
- [All rules](https://nightshade.dicksonwu.xyz/rules.md#authorization-identity-and-membership)
- [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)