# split-witness-identity

> Ledger-bound witness digest and mutation operand use independently supplied witness snapshots without mandatory equality binding.

Canonical: https://nightshade.dicksonwu.xyz/rules/split-witness-identity.html
Release: Nightshade 0.1.1 (v0.1.1)

| Field | Value |
| --- | --- |
| Rule ID | `split-witness-identity` |
| Severity | low |
| Confidence | high |
| Maturity | experimental |
| Selection | Opt-in |
| Policy intent | not required |
| Default enabled | no |
| Category | Other active opt-ins / Authorization, identity and membership |
| Engine facts used | all-predicates, digest-inputs, collection-operations, original-write-history |
| Release | v0.1.1 |

## Selection and scope

Not selected by default. Select it with `--detectors` or the `detectors` list in nightshade.json. Either one replaces profile selection, so list every rule you want.

```sh
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors split-witness-identity
./.nightshade/node_modules/.bin/nightshade detector show split-witness-identity
```

The first command runs only this rule; `--detectors` takes a comma-separated list. The second prints the rule's metadata from your installed version.

Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.

Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.

## Corpus checks

Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.

| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
| ---: | ---: | ---: | ---: | ---: |
| 2/2 | 2/2 | 2/2 | 0/0 | 0 |

No deviations were recorded for this rule.

These are behavior checks on synthetic fixtures, not a precision or recall estimate. See [evaluation](https://nightshade.dicksonwu.xyz/evaluation.md#synthetic-corpus).

## Rule documentation

From https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/split-witness-identity.md at v0.1.1.

Availability: opt-in. Severity: low. Confidence: high.

Opt-in low severity, high confidence review of a precise static relationship.
A successful history enforces a canonical native digest of exact witness input
snapshots equal to definite preexisting ledger data. A Map/Set mutation key (or
same-typed scalar Kernel mutation operand) uses entirely independent supplied
witness snapshots. No mandatory scalar equality connects the observed guard
digest or represented input leaves to the effect operand or its represented
input leaves. Output digest equality and transitive scalar equality can bind the
identities. Checks after the mutation count because they constrain the same
successful transaction.

The first implementation observes exact native digest inputs and resolved
collection operation keys, not arbitrary arithmetic dependencies, stored value
taint, wildcard write paths, or unrelated mutations. Aggregate Kernel operands,
shielded-native recipient structures, collection lookups/member guards, and
other protocol-specific authentication remain outside this contract. It does
not interpret equal hash outputs as equal preimages. Fresh invocations of the
same witness declaration remain independent; unchanged aliases retain identity.
Ledger snapshots and revisions are not converted to live storage identities.

Rule-isolated source observation uses all predicates and original histories.
Missing predicate/digest/collection evidence, optional predicate alternatives
that cannot be decoded, and exhausted allowances produce rule-scoped incomplete
coverage and withhold findings. Baseline completion is independent. Experimental
Counter mode has an absence certificate because the closed terminal Counter
grammar excludes witnesses; other entries route to exact source observations.
Both instruction/reference engines and cached/uncached transfers are covered by
focused compiler-backed tests.

Independent witness values can be intentional when the protocol treats the guard
identity and mutation key as separate roles. The rule reports their unlinked
source relationship; it does not infer caller intent or establish an
authorization bypass.

## Suppress a match

If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:

```compact
// nightshade-disable-next-line split-witness-identity -- Reason this match is intentional
```

Diagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See [configuration](https://nightshade.dicksonwu.xyz/configuration.md#suppress-an-intentional-match) for fingerprint suppressions and baselines.

## References

- [Rule source document at v0.1.1](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/split-witness-identity.md)
- [Catalog entry in rules.json](https://nightshade.dicksonwu.xyz/rules.json)
- [All rules](https://nightshade.dicksonwu.xyz/rules.md#authorization-identity-and-membership)
- [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)