stored-schnorr-key-enrollment-review

Availability: opt-in, informational severity, high confidence in the represented source relationship. No policy required. Select with --detectors stored-schnorr-key-enrollment-review.

Report a surviving raw entry-parameter Jubjub point write to a whole persistent Cell without modeled identity exclusion, paired with an enforced canonical jubjubSchnorrVerify use of an unknown entry-storage snapshot from the same declared Cell without modeled caller or internal identity exclusion. These are separate complete original histories. Common declaration identity does not prove equal values across transactions, a transaction sequence, identity feasibility, unsafe enrollment, sole authorization or application impact.

The exact canonical verifier outcome must be asserted true. Discarded outcomes, constant-returning wrappers, negated-result assertions, another verifier's outcome and a namesake application circuit do not satisfy that condition. Aliases and helpers preserve exact outcome occurrences. Boolean constants, negation and asserted conjunctions are represented; dynamic Boolean equality/inequality relays containing that occurrence produce scoped incomplete diagnostics, including relays inside conjunctions or represented vector/struct comparisons. False or negated whole conjunctions containing that occurrence remain conservatively incomplete. The pinned 0.35.0 and 0.35.0-rc.1 successful canonical verifier calls reject identity internally and are quiet for this conjunction.

All public writers, replacements, reachable helpers/imported instances and constructors are inventoried. The observer examines each successful history's final whole-Cell write; an unchecked temporary overwritten by a checked final point does not qualify. A later exact point check can reject the whole atomic invocation. Committed checkpoint histories are unsupported and produce scoped incomplete diagnostics. Complete writer inventory is not a claim that every stored point is valid. Implicit native defaults and construction are inventoried separately; a constructor's name or deployment use cannot establish trust.

Checks must apply to the exact surviving operand or verifier snapshot. Guards on message data, another parameter, a prior key or a later storage revision do not validate it. Mandatory identity comparisons and qualified native identity-to-identity transfers stay within each original history. An asserted nonidentity ecMul/ecNeg result excludes identity of that exact recorded input, without establishing curve or subgroup membership. Guarded enrollment with an unchecked verifier use is quiet for this conjunction; the existing enrolled-signature-key-review remains independent, including default-state or initialization concerns.

Relevant opaque predicates, lost identity/provenance, missing writer/use histories, malformed observations and exhausted shared allowances make the conjunction unavailable. Unrelated scalar/message checks do not donate validation. Identity compatibility with every constraint and a concrete successful identity input are not proved by missing represented identity exclusion.

Preparation, all exact dependent histories, retained evidence, immutable keys, native/predicate closure and emitted proof rows share the unchanged observation limits (40000 steps, 256 retained paths, 50000 abstract values by default). Point/key traversals also have bounded depth and work limits. Baseline analysis and unrelated detector findings remain independent. The experimental Counter-query mode does not carry this compilation-unit enrollment proof and reports unavailable evidence when selected.

A key enrollment can be intentionally managed by trusted setup or external governance that is not represented in the analyzed source. Such a design can match; the finding does not establish unsafe enrollment or a valid identity-key attack.