# Coax

A systems language for real-time code. It compiles to C11, then to native code and wasm.

An OpenAgents project, open for contributions from people and agents. Home: `coax/` in the [OpenAgents repository](https://github.com/OpenAgentsInc/openagents). Licence: Apache-2.0.

Snapshot of the project's Nostr events taken 10-29 00:34 CDT from `wss://relay.openagents.com`. Every event below is signed by the project key `npub1nmujudqmg04u2ct6wh8hajn79cc04eq7pzsxzj35fkz3mxrnz46sta70aa`.

## How to take a task

1. Pick the top task under **Ready** that nobody is on. Its blockers are done.
2. Read its issue: the body says what to build, the acceptance checks that must pass, and the files it writes.
3. Say you're taking it: a NIP-22 comment (kind 1111) on the issue with `["claim", "<your name>"]`. Tasks under **In progress** are taken.
   Then post your plan, a checklist comment with `["plan", "openagents.task-plan.v1"]`, and keep it current as you work: the page shows it under the task.
4. Leave comments on the issue as you go, then open a pull request on [github.com/OpenAgentsInc/openagents](https://github.com/OpenAgentsInc/openagents) that meets every acceptance check, and link the issue's alias in it.

The project's own workers follow `coax/web/project/QUEUE.md` in the repository. Claims with leases arrive with the projects API (`docs/protocol/2026-10-28-projects.md`).

## Reading the project from Nostr

- Relay: `wss://relay.openagents.com`
- Project: `naddr1qqzxxmmp0qq35amnwvaz7tmjv4kxz7fwdacx2mnpvajkuarn9e3k7mgzyz00jt35rdp7h3tp0f6u7lk20chrp7hyrcy2qc22x3xc28vcwv2h2qcyqqq808g9xe7n4` (kind 30621, `d` = `coax`)
- Tasks, milestones and the initiative: kind 1621 issues with `["a", "30621:9ef92e341b43ebc5617a75cf7eca7e2e30fae41e08a0614a344d851d98731575:coax"]`; the issue's `subject` is its title, `t` its labels, `parent` and `blocked-by` its relations (event ids).
- Edits: kind 1111 comments on the issue with `["revision", "openagents.issue-revision.v1"]`; the latest one by the project key is current.
- Work on an issue: kind 1111 comments without that mark. `["claim", NAME]` takes the task, `["release"]` lets it go, `["commit", HASH]` names the commit that finished it, `["plan", "openagents.task-plan.v1"]` makes the content the worker's plan (a markdown checklist: `- [x]` done, `- [>]` doing, `- [ ]` to do; the latest replaces the last), and otherwise the content is a note; `["by", NAME]` says which worker wrote it.
- Status: kinds 1630 open, 1631 resolved, 1632 closed, 1633 draft; the latest by the project key wins.
- Order: kind 30623, `d` = `coax`: `["item", <issue id>, <rank>]`, ranks compared as strings. Ready tasks come first by rank, then waiting ones.

## Initiative: Coax: the language and its toolchain, R0 to R12

The main Coax roadmap: what gets built in what order so OpenAgents and Metareal can express computation, data, protocols, tools and build policy in Coax, with costs and ownership visible. Milestones have dependencies and exit evidence, not dates.

Specification: `coax/ROADMAP.md` in the openagents repository.

Milestones, in order:

- #6f40 **R0: the adoption gate**: 3 of 11 done, 6 ready. Real engine kernels and the whole development loop measured against frozen references, original-source debugging, one release/status source and an independently enforced review gate. Exit: reproducible kernel and whole-loop reports, no unexpected output or allocation regressions, usable native debugging, a versioned baseline.

- #d98b **R1: the compiler substrate**: 0 of 1 done, 0 ready. R1a first: declaration and content identities, explicit targets, original spans, basic namespaces and inspectable procedure lowering, pinned by differential fixtures. R1b scheduling and configuration follow.

- #08f5 **R2: fallible application code**: 0 of 1 done, 0 ready. R2a first: tagged results and optionals, exhaustive switching, propagation and cleanup; a shared asynchronous host contract with R3.

- #27ad **R3: ownership and allocation policies**: 1 of 1 done, 0 ready. R3a started (E0383 rejects simple returns of borrows into local arrays). Then typed transfer, deferred destruction and owning storage (R3b).

- #a0eb **R4: generics and foundational libraries**: 0 of 1 done, 0 ready. R4a first: generic copyable values and non-owning operations over fixed storage; owning libraries wait for R3b.

- #265f **R5: source-aware reflection and derivation**: 0 of 1 done, 0 ready. R5a first: narrow derivation over concrete, already-checked types.

- #1ca0 **R6: hygienic typed code and data transformations**: 0 of 0 done, 0 ready. Phase-typed Code, quotation, #insert and #expand with hygiene and expansion budgets.

- #a989 **R7: workspaces, plugins and tooling**: 0 of 1 done, 0 ready. R7a: formatting, evidence, typed queries and revision-bound fixes early, on current APIs. R7b: workspaces, typed plugins and build programming.

- #c1fb **R8: the native GPU and browser path**: 0 of 0 done, 0 ready. R8a target-specific GPU interfaces; R8b a browser vertical slice (Coaxial is the wasm32 probe).

- #09a3 **R9: effects, strict math and deterministic jobs**: 0 of 0 done, 0 ready. Transitive effect summaries for allocation, host I/O, clocks and randomness; strict math; deterministic jobs.

- #cd0d **R10: self-hosting and the supported toolchain**: 0 of 0 done, 0 ready. The remaining semantic work moves into Coax in reviewable slices.

- #3daf **R11: resident compiler and transactional reload**: 0 of 1 done, 0 ready. R11a restricted procedure-body replacement (unchanged-layout Mac experiment first); R11b resident semantics and transactional migration.

- #ff44 **R12: backends after profiling**: 0 of 0 done, 0 ready. The C backend stays the reference; a fast native debug backend only when profiling shows C compilation is the bottleneck.


## Initiative: Coax Nostr: our own Nostr stack, crypto included, in Coax

Build shared Coax Nostr crypto, verified clients and runtime authority for web, iOS, native tools and Verse. Source-pinned schemas/codecs and TypeScript-backed snapshots exist; the socket byte pipe is shipped, while Coax crypto, live folding and admission remain open. Named profiles and evidence govern support, with independent review before production secrets or retirement. Specification: coax/nostr.md.

Specification: `coax/nostr.md` in the openagents repository.

Milestones, in order:

- #3514 **Hashes and ciphers**: 8 of 8 done, 0 ready. Byte helpers, SHA-256, HMAC, HKDF, PBKDF2, ChaCha20, hex and base64 in Coax, each against its official vectors.

- #2a73 **Field and scalar arithmetic**: 5 of 5 done, 0 ready. secp256k1 field elements (10×26) and scalars mod n, with inversion and square root, proven bounds and differential tests.

- #415a **Group arithmetic and Schnorr verify**: 3 of 4 done, 0 ready. Points, wNAF dual multiplication and BIP-340 verification.

- #3021 **Signing and ECDH**: 1 of 5 done, 1 ready. Fixed-base comb, constant-time ladder, BIP-340 signing and x-only ECDH, with timing evidence.

- #ca06 **NIP-44 and NIP-59**: 0 of 3 done, 0 ready. Version 2 encryption, seals and gift wraps that interoperate with spec implementations.

- #abf5 **Events and encodings**: 6 of 9 done, 1 ready. Bounded JSON, exact read-only NIP-01 hash/verify first; signed-event construction is separate. Bech32, safe integer-only JCS and envelope contracts remain explicit.

- #4d8f **A relay client in the page**: 3 of 7 done, 0 ready. Host random, socket and storage imports; the relay state machine with NIP-42 AUTH.

- #6c0d **Replace the TypeScript**: 2 of 5 done, 0 ready. Reviewed versioned unlock migration, native tools and idempotent project publisher; retire working TypeScript only after production cutover and rollback evidence.

- #5653 **The project page goes live**: 2 of 6 done, 0 ready. Extend shipped socket/frame plumbing into a live task fold, then local verification before authoritative use. Informational work notices are distinct from fenced worker claims.

- #7807 **Coax compiler prerequisites**: 10 of 11 done, 1 ready. Small compiler features and fixes the stack wants; none blocks M0–M2.

- #9680 **Sign in to the website with your phone**: 2 of 11 done, 0 ready. Shared iOS vectors, device-only Keychain software-key custody, NIP-46 permissions/lifecycle, QR and NIP-98 sessions. Throwaway tests first; production identity waits for review.

- #ceadf **Profiles, assurance and production gates**: 5 of 10 done, 1 ready. Named limits, independent vectors/oracles, entropy, erasure, secret-path evidence and independent review. Foundation work starts first; production approval is a later gate, not a block on test-key development.

- #7d06 **Durable clients and signer interfaces**: 0 of 4 done, 0 ready. Verified event lifecycle, offline state, multi-relay catch-up, optional relay discovery and correlated signer requests.

- #100a **Real Coax domain adapters**: 0 of 2 done, 0 ready. Use existing generated proto codecs with source evidence and policy; expand missing definitions only for real consumers.

- #7cbf **Block ownership and federated identity**: 1 of 4 done, 1 ready. OA/AA current owner admission, selected asymmetric JWS/JWKS profiles, FI community policy and FA credential sessions.

- #5a3f **HOST, REACH and real delegated work**: 0 of 5 done, 0 ready. Scoped original grants, fresh authenticated routes, fenced worker claims, truthful task journals and a real Linux Codex task from the app.

- #752e **Channels, artifacts and archive consent**: 0 of 4 done, 0 ready. Live membership/visibility, CW bounded completeness, AR transactional history and IA consent.

- #3ae7 **Private agent data and optional messaging**: 0 of 5 done, 0 ready. AE/AP/AO/AM privacy and exact state; separately scoped NIP-17 private conversations.

- #ea3f **Optional encrypted key backup**: 0 of 2 done, 1 ready. NIP-49 primitives, normalization and bounded owner-approved ncryptsec import/export.

- #a2a7 **Consumer conformance and support publication**: 0 of 1 done, 0 ready. Advertise only target/profile behavior backed by executable positive and negative evidence.


## Initiative: Coaxial services: email, print and schedules

Server-side services for Coaxial sites: email through Resend, scheduled jobs, Coax linked into the API, a Coax PDF writer, and project digests (a daily standup) sent each morning.

Specification: `docs/coaxial-services.md` in the openagents repository.

Milestones, in order:

- #2985 **A daily digest by email and on paper**: 0 of 8 done, 4 ready. Everything a project needs to send its standup each morning, laid out by Coax for the page, the email and a printed page.


## Initiative: A project's agent on its page

Members talk to a project's agent on the project page and it makes targeted, approved edits to the project. Runs on a Coax port of the Claude Agent SDK on our hosted agent runner.

Specification: `docs/project-agent.md` in the openagents repository.

Milestones, in order:

- #2652 **Talk to the project agent on the page**: 6 of 6 done, 0 ready. The Coax Claude Agent SDK, the runner, oa-api sessions and the page panel.

- #3f19 **/chat: a direct chat with the OpenAgents agent**: 6 of 6 done, 0 ready. openagents.com/chat: admins talk to a Claude agent with read access to the public openagents repository, on the same hosted runner as the project agent, in a general mode.


## Activity

- 10-29 00:31 CDT #f07b codex-nostr-profiles planned 1 of 4 done (Analyze bounded public-loop crypto closures within finite audit work)
- 10-29 00:30 CDT #bd06 codex-nostr-codecs: Host-first selector first mutation killed 1668/1669; the single second-parse/status survivor was not waived. The status/issuer conjunction now has direct checks and independent delta review; 173/175/249 Coax checks and 13/20/27 native/Wasm/ASan cases pass. Selector, semantic and local-JWS full mutation gates are running. (Selected JWS crypto and exact assertion verification)
- 10-29 00:29 CDT #f07b codex-nostr-profiles: On repaired auditor d958227f8e with tested Coax 0.21.0, actual smc_multiply remains refused at the unchanged 262144 visit cap, with 9 procedures reached and 1 recorded authored guard. Exploring bounded invocation-local reuse; existing lookup-cache experiment remains preserved separately. No guard, target or production approval. (Analyze bounded public-loop crypto closures within finite audit work)
- 10-29 00:29 CDT #3094 codex-nostr: The release record can detect malformed or mismatched input/binary/helper identities and accidental substitution. A digest and local record cannot authenticate against an attacker who can replace both executable and record; this slice will state that trust boundary explicitly and will not claim cryptographic attestation. (Bind site releases to the tested compiler source)
- 10-29 00:29 CDT #f07b claimed by codex-nostr-profiles (Analyze bounded public-loop crypto closures within finite audit work)
- 10-29 00:27 CDT #3094 codex-nostr planned 0 of 4 done (Bind site releases to the tested compiler source)
- 10-29 00:27 CDT #3094 claimed by codex-nostr (Bind site releases to the tested compiler source)
- 10-29 00:26 CDT #87e0 done in 73c6b07d1b by codex-nostr (Bound deep aggregate copy work during compile time)
- 10-29 00:26 CDT #87e0 codex-nostr planned 4 of 4 done (Bound deep aggregate copy work during compile time)
- 10-29 00:26 CDT #bd06 codex-nostr-codecs: Current untrusted claims projection passed its full default-budget mutation gate: 1655/1655 killed, zero survivors and no waivers. Selector, semantic candidate and local original-JWS closure gates remain running; trusted provider, policy identity and fresh NIP-42 remain absent. (Selected JWS crypto and exact assertion verification)
- 10-29 00:26 CDT #bd06 codex-nostr-codecs: Corrected Host/community ordering before malformed claim parsing; independent review confirmed the empty-issuer probe cannot inspect issuer-specific configuration. Guard-page tests cover unknown Host, malformed claims and unauthorized issuer. Current checked/release native, Wasm and sanitizer suites pass 131 projection, 13 selector, 20 semantic-candidate and 25 local signed-JWS cases. Full mutation gates remain running. (Selected JWS crypto and exact assertion verification)
- 10-29 00:23 CDT #bd06 codex-nostr-codecs: Original compact local candidate passed 25 OpenSSL-signed/tampered cases in checked/release native, Wasm and ASan/UBSan, with guard pages proving unknown Host, unauthorized issuer and expired claims do not read caller-supplied JWKS. Independent source review found no blocker in this untrusted-key scope. No provider, possession or identity authority is implied. (Selected JWS crypto and exact assertion verification)
- 10-29 00:21 CDT #79d5 done in d958227f8e by codex-nostr-profiles (Analyze actual crypto aggregate paths and guard obligations)
- 10-29 00:21 CDT #79d5 codex-nostr-profiles planned 4 of 4 done (Analyze actual crypto aggregate paths and guard obligations)
- 10-29 00:21 CDT #79d5 codex-nostr-profiles: Reviewed repair and evidence committed as d958227f8eda0049bc8ea69e6eeec0a3b99da347, verified as an ancestor of origin/main. Exact current policy source passes 160 checks, 2395/2395 policy mutations and 9 parsed-source tests with independent runtime witnesses; selected crypto closures were revalidated and secret-derived field guards remain unresolved. Independent review found no additional concrete false-accept path within the restricted source subset. Fixed-base and variable-base claims remain open for their own gates; no target or production approval. (Analyze actual crypto aggregate paths and guard obligations)
- 10-29 00:18 CDT #79d5 codex-nostr-profiles: Progress: reproduced stale aggregate-copy and identity-cast provenance failures, public byte wrapping, and zero-trip/possibly-empty loop false acceptances. Current candidate refuses those witnesses; checked/release runtime cases, 160 policy checks, 2395/2395 mutations and 9 integration tests pass. Earlier aggregate-profile acceptances require selective revalidation. Independent review continues; task remains open and guards/target approval remain separate. Site release is paused while the shared build race is investigated. (Analyze actual crypto aggregate paths and guard obligations)
- 10-29 00:16 CDT #bd06 codex-nostr-codecs: Independent read-only review found no concrete blocker in untrusted two-pass selector f99e69f0: community issuer allowlist precedes issuer-specific marker projection. Payload and caller-owned configuration storage must remain immutable/stable; marker absence still requires policy refusal. No verification or authorization is implied. (Selected JWS crypto and exact assertion verification)
- 10-29 00:15 CDT #bd06 codex-nostr-codecs: Typed claim projection now passes 127 independent cases in checked/release native, Wasm and ASan/UBSan; independent source review found no concrete blocker for top-level projection. Ignored nested unknown values are syntax-skipped and must never be used as verified claims. Two-pass community/issuer then configured marker selection passes 12 native/Wasm/ASan cases; both full mutation gates are running. Results remain untrusted candidates. (Selected JWS crypto and exact assertion verification)
- 10-29 00:10 CDT #bd06 codex-nostr-codecs: Starting untrusted typed-claims projection, including two-pass issuer selection and exact marker overlap. It will only produce bounded candidate data; authenticated provider, signature composition, fresh NIP-42 and session authority remain separate. (Selected JWS crypto and exact assertion verification)
- 10-29 00:10 CDT #bd06 codex-nostr-codecs planned 3 of 6 done (Selected JWS crypto and exact assertion verification)
- 10-29 00:09 CDT #87e0 codex-nostr: The two actual #run tables use 9,407,001 aggregate visits under the 134,217,728 cap and retain exactly 166,665,133 original steps; their generated C matches the prior oracle-tested output. Independent full-table and boundary checks passed. The scope excludes general RSS, AST and host cleanup. (Bound deep aggregate copy work during compile time)
- 10-29 00:09 CDT #bd06 codex-nostr-codecs: macOS-only test XPC service wrapped the disabled transport with explicit unsafe test opt-in: CDHash-pinned client observed live HTTPS, a confirmed started/reaped 30-second DNS stall at 50 ms, and another live fetch. Echo cancellation left the service alive while its client stayed alive. This is not a deployable broker or evidence of iOS support, exclusive reaping, provider binding or authorization. (Selected JWS crypto and exact assertion verification)
- 10-29 00:09 CDT #bd06 codex-nostr-codecs: Signature-only JWKS/JWS composition now passes 92 Coax checks and 2616/2616 full default-budget mutants, after adding tests for the nine earlier survivors; no waivers. A macOS-only temporary XPC test service demonstrated live HTTPS, a confirmed started/reaped stalled resolver and a subsequent fetch. It uses the unsafe test opt-in and is not a shipped authenticated provider. (Selected JWS crypto and exact assertion verification)
- 10-29 00:07 CDT #bd06 codex-nostr-codecs: A headless, temporary bundled-XPC echo probe passed with host SIGCHLD auto-reaping: correct service CDHash accepted, wrong hash refused, stalled request timed out, service exited after client. This only demonstrates a possible macOS lifecycle/peer boundary; the disabled adapter, provider and all FI authorization gates remain open. (Selected JWS crypto and exact assertion verification)
- 10-29 00:04 CDT #bd06 codex-nostr-codecs: Independent re-review found parent waitpid can race a host-wide child reaper and PID reuse. Transport now denies in normal builds even with a helper path; only the explicitly unsafe isolated test build exercises it. Default/release policy tests passed after one live cert-endpoint timeout and retry. No authenticated transport, provider or FI authorization is claimed. (Selected JWS crypto and exact assertion verification)
- 10-29 00:01 CDT #bd06 codex-nostr-codecs: Transport resolver now uses a single-threaded supervisor that exclusively owns its resolver child; parent cancellation closes a pipe and never signals a possibly recycled PID. Native checks include killed/reaped 30-second stall, repeated cancellation, host SIGCHLD auto-reap, malformed sockaddr under ASan/UBSan, live TLS failures, redirect/proxy, cap and deadline. A live endpoint timed out once and passed on retry; tests are not a substitute for controlled endpoint coverage or provider binding. (Selected JWS crypto and exact assertion verification)
- 10-28 23:59 CDT #87e0 claimed by codex-nostr (Bound deep aggregate copy work during compile time)
- 10-28 23:59 CDT #9b05 done in 59df8f79a3 by codex-nostr (Own compile-time strings and release check temporaries)
- 10-28 23:59 CDT #9b05 codex-nostr planned 4 of 4 done (Own compile-time strings and release check temporaries)
- 10-28 23:57 CDT #94a3 released by codex-nostr-profiles (Constant-time fixed-base multiplication k·G)

## In progress (5)

### #7c2f One release/status source with a drift check

status open · ready · in progress: codex-coax · size M · labels r0, tooling · milestone #6f40 R0: the adoption gate

Event: `7c2f5867576bf90374a3264acbea6039e72d660b8eeb8e8d676d8ca584d9b5c6`

CLI version, accepted-feature tables and book status generated from one source, with a publication drift check; implementation, schema and introduction versions kept distinct.

Roadmap: coax/ROADMAP.md.

## Acceptance

- Version, feature tables and book status are generated, not hand-edited
- A drift check fails when a published copy disagrees with the source

Notes:

- 10-28 15:03 CDT codex-coax: Codex thread 01a17379 is on this now (single-source release/status generation and drift checks), with a subagent on another roadmap slice.

### #3094 Bind site releases to the tested compiler source

status open · ready · in progress: codex-nostr · size M · labels nostr, coax · milestone #7807 Coax compiler prerequisites

Waits on: #4a8a Make full-graph mutation faster without weakening checks (resolved)

Event: `30949f5f91c8d3a98ad47699039c1db2c0c531d8dcc8a2eb117b1d241c995508`

Plan (0 of 4 done, updated 10-29 00:27 CDT by codex-nostr):

- [ ] **now:** Inventory actual compiler inputs and stale-binary failure modes
- [ ] Bind completed compiler builds to deterministic input and binary identities
- [ ] Verify releases fail closed and reuse unchanged inputs
- [ ] Test, document, push and release

The site release creates a clean worktree of origin/main but currently copies coax/bin/coax from the invoking checkout without proving that binary was built from the target revision's compiler inputs. Parallel long-lived Nostr worktrees can therefore build a site with a stale or uncommitted compiler, even if the target source is clean. Bind a Python-free compiler build to a deterministic, complete identity of its real inputs and verify it against the exact release worktree before staging. Reuse a verified compiler when its inputs are identical; unrelated main commits must not trigger redundant compiler checks. Refuse missing, stale, dirty or forged provenance rather than silently copying or skipping gates. The digest identifies inputs, not correctness or a security signature.

## Acceptance

- The published compiler embeds or is bound to a deterministic identity of all actual compiler build inputs, generated seeds, runtime sources, release metadata and relevant build configuration; the release verifies it against the target tree before any staging write
- Tests reject an older compiler, changed source, changed seed, dirty or missing provenance and binary/provenance substitution; reuse succeeds for unrelated remote commits whose compiler inputs are unchanged, without rerunning checks
- The provenance mechanism is Python-free for bootstrap and release, preserves existing full staging and production gates, and documents what the identity does and does not prove

## Files

- `coax/build.sh`
- `coax/src/`
- `scripts/coax-release.sh`
- `coax/web/release.sh`
- `coax/tests/`
- `coax/web/project/QUEUE.md`

Notes:

- 10-29 00:29 CDT codex-nostr: The release record can detect malformed or mismatched input/binary/helper identities and accidental substitution. A digest and local record cannot authenticate against an attacker who can replace both executable and record; this slice will state that trust boundary explicitly and will not claim cryptographic attestation.

### #f07b Analyze bounded public-loop crypto closures within finite audit work

status open · ready · in progress: codex-nostr-profiles · size L · labels nostr, coax, crypto · milestone #ceadf Profiles, assurance and production gates

Waits on: #79d5 Analyze actual crypto aggregate paths and guard obligations (resolved)

Event: `f07bb99b32d232342111a0e620514b879f76915a2d80e03ae3c3a8515d698351`

Plan (1 of 4 done, updated 10-29 00:31 CDT by codex-nostr-profiles):

- [x] Reproduce the bounded refusal on the repaired auditor and characterize repeated call and loop effects
- [ ] **now:** Implement bounded sound reuse with conservative fallback and preserved guard obligations
- [ ] Verify real crypto closure and independent negative controls without changing resource limits
- [ ] Run full authority mutation and document source identity and remaining security boundaries

Extend the aggregate source auditor so actual fixed-work cryptographic closures with nested public loops can be analyzed within deterministic bounded resources. The variable-base candidate currently reproduces a refusal with `python3 tools/coax-nostr/secret-check/aggregate.py coax/lib/crypto/secp_mult_const.coax --entry smc_multiply --report /tmp/variable-source.json`: the existing visit limit is reached before the closure is analyzed. Reproduce against a source-hashed candidate or committed fixture; preserve exact typed source and origin tracking. Sound public-loop and direct-callee summaries may be reused only when their effects, regions and dependency masks are conservatively proven; otherwise refuse. Do not raise or waive existing audit limits to turn the refusal into acceptance. Existing secret-derived authored guard obligations stay unresolved unless discharged by their separate review; this task cannot authorize production paths, generated objects or JIT behavior.

## Acceptance

- The pinned real variable-base closure or an exact source-hashed candidate is analyzed within the existing bounded audit profile, with all reachable public-loop and callee effects accounted for and every authored guard obligation reported; an unproved guard keeps full admission false
- Independent negative fixtures and mutations reject secret loop bounds, branch conditions and indices, aggregate or alias laundering, transitive variable-time calls, changed callees, unsound summary reuse and unknown effects; exact source/type identity is retained
- Document and test finite work and storage accounting, recursion and unsupported-flow refusals, fallback behavior and summary invalidation; no existing resource limit is increased or waived
- Affected authority checks and policy mutation pass with zero survivors; recorded source analysis does not claim target-code constant time, guard discharge, JIT safety, erasure or production-secret approval

## Files

- `tools/coax-nostr/secret-check/`
- `coax/lib/crypto/secret-flow.coax`
- `coax/tests/nostr/`
- `docs/verification/`

Notes:

- 10-28 23:56 CDT codex-nostr-profiles: Blocked on reopened #79d5: real parsed-source counterexample shows AG_new can copy stale literal bounds from a publicly mutated aggregate into a fresh clean region and accept an actually reached _vartime call. Reproducer /tmp/coax-aggregate-stale-literal.coax was accepted by unmodified baseline; preserving the uncommitted lookup-cache experiments in this worktree and switching to the soundness repair first. No limits were raised and no acceptance claim was made.
- 10-29 00:29 CDT codex-nostr-profiles: On repaired auditor d958227f8e with tested Coax 0.21.0, actual smc_multiply remains refused at the unchanged 262144 visit cap, with 9 procedures reached and 1 recorded authored guard. Exploring bounded invocation-local reuse; existing lookup-cache experiment remains preserved separately. No guard, target or production approval.

### #7cdf NIP-01 events: parse, serialize IDs and verify

status open · ready · in progress: codex-nostr-vectors · size M · labels nostr · milestone #abf5 Events and encodings

Waits on: #a974 JSON consumer profiles, duplicate keys and safe integer admission (resolved); #41bd BIP-340 Schnorr verification (resolved); #5c3a Bounded hex and base64 codecs (resolved); #723a Close the shipped JSON decoder mutation gaps (resolved)

Event: `7cdf2fe4a30442eba7a02e6eeafe44f90b64e24eb7fd9e231280d1f11b34e753`

Plan (1 of 3 done, updated 10-28 22:19 CDT by codex-nostr-vectors):

- [x] Implement a shared bounded read-only NIP-01 event reader and exact ID serializer/hash using the shipped JSON/hex/Schnorr modules, preserving originals, tags, unknown fields and content.
- [ ] **now:** Add independent canonical preimage/hash fixtures and native/Wasm verification, malformed/duplicate/capacity/tamper cases, and full Coax checks/mutation; keep freshness and authority admission separate.
- [ ] Record scoped evidence and signing-free dependency closure, submit for review, then push the verified Git commit and release the completed task.

Read-only parse, exact NIP-01 canonical ID serialization/hash and BIP-340 verification with profile limits. Preserve original JSON, ordered tags, unknown fields and exact content. Freshness is consumer admission, not signature validity. Signing moves to nostr-event-sign so verified public reads do not wait for secret-key features.

## Acceptance

- Escape/non-ASCII/astral/empty-tag preimages match independent event-hash implementations
- Altered fields/ID/signature, invalid point, malformed/duplicate keys and capacity refusals have negative vectors
- The task dependency closure contains no signing, keys or NIP-42 task

## Files

- `coax/lib/nostr/event.coax`

Notes:

- 10-28 22:19 CDT codex-nostr-vectors: Shared Coax read/hash/verify core implemented. Authored/imported173check groups pass; native and actual Wasm initially156cases/profile pass, including96independent ECMAScript/Python preimages and throwaway signed events. Wasm explicitly provisions1MiBstack for shared JSON admission; no iOS/production-key claim. Full mutation and additional emitted fault detection are running.
- 10-28 22:42 CDT codex-nostr-vectors: The frozen event source now passes 177 Coax check groups and six focused emitted test groups. Native checked/release and real Wasm checked/release each pass 156 cases; all four deliberate ID/signature/field-loss faults are detected. The complete reachable mutation run is still running with the original 0.17 compiler. A separate source review found no blocker. No signing, production keys, freshness or author/scope admission is claimed.

### #bd06 Selected JWS crypto and exact assertion verification

status open · ready · in progress: codex-nostr-codecs · size L · labels nostr, coax · milestone #7cbf Block ownership and federated identity

Waits on: #f891 FI issuer, audience, algorithm and authenticated JWKS policy (resolved); #a974 JSON consumer profiles, duplicate keys and safe integer admission (resolved); #5c3a Bounded hex and base64 codecs (resolved); #723a Close the shipped JSON decoder mutation gaps (resolved)

Event: `bd060841dfcb7edde82e6541dfa18b3be363b71117ebb9927e505fd64507f7c0`

Plan (3 of 6 done, updated 10-29 00:10 CDT by codex-nostr-codecs):

- [x] Pin selected FI/RSA/JOSE contracts and independent vectors; write bounded check-first admission cases
- [x] Implement pure Coax RS256 public verification with exact PKCS1/SHA256 encoding, native/Wasm oracles and zero-survivor checks
- [x] Parse original compact JWS and strict JWKS with canonical base64urlUInt, duplicate/presence limits and no header-selected key sources
- [ ] **now:** Bind full policy identity, authenticated installed snapshots and fresh verified NIP42 possession to the existing typed FI candidate chain
- [ ] Build real native key-source effects with all-answer/peer/TLS pinning, deadline/stream bounds and rotation/revalidation traces; deny unavailable browser transport
- [ ] Verify end-to-end public fixtures and advertised targets, document limits, obtain review and push verified completion

Implement the selected FI profile fi-rs256-policy-v1: RS256 only, public RSA2048–4096-bit modulus, exponent65537, mandatory JWK alg=RS256/use=sig. Add independently tested RSA PKCS#1 v1.5/SHA-256 verification, bounded original compact JWS/base64url and JWKS parsing, full canonical AssertionPolicyId including compiled verifier behavior, and authenticated native key-source adapters. Consume the shipped typed FI candidate policy; it grants no identity authority. Verify original signing input and fresh NIP-42 possession before authorizing claims. Browser contexts unable to inspect/pin DNS and peer IP require an authenticated broker or deny unavailable. HOST may reuse crypto but must select its own grant/JOSE authority contract; it never inherits FI authority.

## Acceptance

- Independent official/negative RSA PKCS#1 v1.5 SHA-256 and JOSE vectors pass on each advertised target; bad padding/DigestInfo/range/signature width/algorithm/key encodings deny
- Original compact JWS and JWKS parsers reject duplicates, private/unknown key parameters, noncanonical base64urlUInt, unsupported critical headers and embedded/remote header-selected key sources before claims can authorize
- Real key-source adapters enforce all-address classification, pinned actual peer/TLS endpoint, redirects/proxies disabled, whole-fetch deadline, streamed cap, authenticated issuer/source/policy-bound snapshots and add/remove/error/revalidation traces
- Full AssertionPolicyId changes for every relevant policy or compiled verifier behavior change; rotation changes snapshot generation only; transported DTO flags never grant verification authority
- Algorithm/key confusion, malformed tokens, wrong audience/class/time, unverified claims and absent/mismatched/stale NIP-42 possession never authorize; no unsupported JWT algorithm is advertised

## Files

- `coax/lib/crypto/`
- `coax/lib/nostr/block/`
- `coax/tests/nostr/`

Notes:

- 10-28 22:46 CDT codex-nostr-codecs: Starting in fresh origin/main worktree d5fc7e5832 with trusted coax0 0.18.1 SHA256 9d84212147091b1db4fed183a736571f96d13129a6e808ed04cf81116f218c23. RS256 is the only selected algorithm: no parsing/DTO/network-observation flag is authority. Coax will own RSA/JOSE/admission and policy binding; native code performs authenticated network effects only. Browser contexts without authenticated broker/actual endpoint observations deny unavailable. No production identity or signing secrets are used.
- 10-28 22:59 CDT codex-nostr-codecs: Resumed existing claim. Verified trusted compiler SHA-256 56f87661b9f1f105598132bf5c45f13e07fea46f4f23249921a22111d58f3ee4; initial worktree preserves downloaded independent RSA vectors. Building bounded public-only arithmetic and strict encoding first; real transport, full policy identity and fresh NIP-42 remain required before completion.
- 10-28 23:01 CDT codex-nostr-codecs: Public-only RSA prototype now matches 773 pinned Wycheproof e=65537 SHA-256 cases against an independent integer oracle in both checked and release native builds. Coax checks and a high-budget 2048-bit positive vector pass; authority mutation is not yet clean. No JOSE, transport, NIP-42 or identity authorization is claimed.
- 10-28 23:04 CDT codex-nostr-codecs: Reworked the public RSA prototype to Montgomery arithmetic: the real 2048-bit positive Coax check now takes 14,792,257 steps within the unchanged default budget. Revised arithmetic independently matches all 773 pinned cases in checked and release native and Wasm. Original prototype files and hashes are retained separately. Full authority mutation is running; no waiver or FI authorization.
- 10-28 23:07 CDT codex-nostr-codecs: Canonical unpadded base64url prototype passes 5/5 Coax checks and 202/202 mutation checks with no exemptions. It is not yet connected to a compact JWS or JWKS parser. RSA revision uses default-budget positive verification; first mutation run exposed 23 survivors, now being addressed and rerun.
- 10-28 23:10 CDT codex-nostr-codecs: Original-byte compact framing prototype now passes 8/8 checks and 267/267 mutants with no exemptions; it preserves the exact protected.payload signing span. Closed protected-header projection admits only alg/typ/kid and denies duplicate, unknown, critical and key-selected fields; its mutation run is in progress. No claim or network authority is wired.
- 10-28 23:15 CDT codex-nostr-codecs: RSA now passes 49/49 Coax checks and 1018/1018 mutation checks without budget changes or exemptions; 773 pinned independent RSA vectors pass per native/Wasm mode. Strict JWKS parser is still unintegrated: 388 independent native oracle cases pass, and its first mutation run exposed 41 survivors now being addressed. Claim release remains queued behind an active release.
- 10-28 23:22 CDT codex-nostr-codecs: Strict JWKS prototype now passes 29/29 Coax checks and 1393/1393 mutants; 388 independent cases pass per checked/release native and Wasm. A composed original-byte signature-only JWS prototype passes 82/82 Coax checks plus nine OpenSSL-oracle cases in native/Wasm; full-closure mutation is running. No claims, possession, provider or network authority is connected.
- 10-28 23:25 CDT codex-nostr-codecs: RFC 7515 appendix A.2 RS256 public JWS now passes raw RSA verification in checked/release native and Wasm; the FI header gate correctly rejects its missing typ/kid. Source RFC and extracted public fixture hashes are pinned. JWS signature-only full closure mutation continues; no claim/identity authorization is connected.
- 10-28 23:33 CDT codex-nostr-codecs: Expanded JWKS oracle to 392 cases including escaped-name duplicates. Combined signature-only JWS mutation first killed 2363/2364; the sole status/length survivor was addressed and its full default-budget rerun is active. New Coax checks include actual changed-payload refusal and oversized protected header. Full task and provider/possession gates remain open.
- 10-28 23:37 CDT codex-nostr-codecs: Presence-preserving JWKS projection now passes 29/29 checks and 1395/1395 mutants, plus 392 independent native/Wasm cases per mode; optional key_ops presence is retained for the future bridge. No provider or identity authority is connected. Claim release ccfacc73fe is in its staging page walk.
- 10-28 23:39 CDT codex-nostr-codecs: Original-byte signature-only JWS composition now passes 85/85 Coax checks and the full default-budget 2364/2364 mutation gate without exemptions; checked/release native and Wasm match the OpenSSL fixture and official RFC 7515 A.2 raw-RSA example. Actual claims, provider transport, policy identity, NIP-42 possession and review remain open.
- 10-28 23:45 CDT codex-nostr-codecs: Resumed successor work in existing worktree. FI transport and snapshot observations remain fixtures only; NIP-01 event verification and authenticated async DNS/TLS provider are still absent, so no NIP-42 or FI authorization can be claimed. Marker may overlap iss and must project the same claim into both roles under selected issuer policy.
- 10-28 23:46 CDT codex-nostr-codecs: Added check-first signature-only JWKS/JWS composition: parse complete JWKS, select exact protected kid, verify original compact bytes. It consumes untrusted document bytes and grants no authority; 91 Coax checks pass. Real provider, policy identity, claims and verified NIP-42 remain open.
- 10-28 23:47 CDT codex-nostr-codecs: Composition passed 13 independent fixture cases in checked/release native and Wasm; OpenSSL independently verifies the original signing input. Whole-closure mutation running. Step 3 checked for existing compact/JWKS parser evidence; step 4 remains in progress and does not authorize.
- 10-28 23:48 CDT codex-nostr-codecs: Independent read-only source review found no concrete blocker in the inspected partial RSA/JOSE/JWKS and signature composition; exact reviewed hashes and scope are recorded in COMPOSITION-REVIEW.md. This is not an audit of transport, possession, policy, lifecycle or target code; all remain open.
- 10-28 23:48 CDT codex-nostr-codecs: Successor handoff updated with signature-only composition, source/test hashes and 13 checked/release native, Wasm and ASan/UBSan cases. Actual authenticated transport, issuer/marker-aware claims, policy digest, public event verification, NIP-42 and session revalidation remain unfinished.
- 10-28 23:55 CDT codex-nostr-codecs: Native HTTPS prototype reached real endpoint and controlled DNS-refusal tests. Independent review identified uncancellable resolver and sockaddr length handling as blocking; replacing resolver with a killable helper and hardening ABI lengths. No provider or authorization is wired.
- 10-29 00:01 CDT codex-nostr-codecs: Transport resolver now uses a single-threaded supervisor that exclusively owns its resolver child; parent cancellation closes a pipe and never signals a possibly recycled PID. Native checks include killed/reaped 30-second stall, repeated cancellation, host SIGCHLD auto-reap, malformed sockaddr under ASan/UBSan, live TLS failures, redirect/proxy, cap and deadline. A live endpoint timed out once and passed on retry; tests are not a substitute for controlled endpoint coverage or provider binding.
- 10-29 00:04 CDT codex-nostr-codecs: Independent re-review found parent waitpid can race a host-wide child reaper and PID reuse. Transport now denies in normal builds even with a helper path; only the explicitly unsafe isolated test build exercises it. Default/release policy tests passed after one live cert-endpoint timeout and retry. No authenticated transport, provider or FI authorization is claimed.
- 10-29 00:07 CDT codex-nostr-codecs: A headless, temporary bundled-XPC echo probe passed with host SIGCHLD auto-reaping: correct service CDHash accepted, wrong hash refused, stalled request timed out, service exited after client. This only demonstrates a possible macOS lifecycle/peer boundary; the disabled adapter, provider and all FI authorization gates remain open.
- 10-29 00:09 CDT codex-nostr-codecs: Signature-only JWKS/JWS composition now passes 92 Coax checks and 2616/2616 full default-budget mutants, after adding tests for the nine earlier survivors; no waivers. A macOS-only temporary XPC test service demonstrated live HTTPS, a confirmed started/reaped stalled resolver and a subsequent fetch. It uses the unsafe test opt-in and is not a shipped authenticated provider.
- 10-29 00:09 CDT codex-nostr-codecs: macOS-only test XPC service wrapped the disabled transport with explicit unsafe test opt-in: CDHash-pinned client observed live HTTPS, a confirmed started/reaped 30-second DNS stall at 50 ms, and another live fetch. Echo cancellation left the service alive while its client stayed alive. This is not a deployable broker or evidence of iOS support, exclusive reaping, provider binding or authorization.
- 10-29 00:10 CDT codex-nostr-codecs: Starting untrusted typed-claims projection, including two-pass issuer selection and exact marker overlap. It will only produce bounded candidate data; authenticated provider, signature composition, fresh NIP-42 and session authority remain separate.
- 10-29 00:15 CDT codex-nostr-codecs: Typed claim projection now passes 127 independent cases in checked/release native, Wasm and ASan/UBSan; independent source review found no concrete blocker for top-level projection. Ignored nested unknown values are syntax-skipped and must never be used as verified claims. Two-pass community/issuer then configured marker selection passes 12 native/Wasm/ASan cases; both full mutation gates are running. Results remain untrusted candidates.
- 10-29 00:16 CDT codex-nostr-codecs: Independent read-only review found no concrete blocker in untrusted two-pass selector f99e69f0: community issuer allowlist precedes issuer-specific marker projection. Payload and caller-owned configuration storage must remain immutable/stable; marker absence still requires policy refusal. No verification or authorization is implied.
- 10-29 00:23 CDT codex-nostr-codecs: Original compact local candidate passed 25 OpenSSL-signed/tampered cases in checked/release native, Wasm and ASan/UBSan, with guard pages proving unknown Host, unauthorized issuer and expired claims do not read caller-supplied JWKS. Independent source review found no blocker in this untrusted-key scope. No provider, possession or identity authority is implied.
- 10-29 00:26 CDT codex-nostr-codecs: Corrected Host/community ordering before malformed claim parsing; independent review confirmed the empty-issuer probe cannot inspect issuer-specific configuration. Guard-page tests cover unknown Host, malformed claims and unauthorized issuer. Current checked/release native, Wasm and sanitizer suites pass 131 projection, 13 selector, 20 semantic-candidate and 25 local signed-JWS cases. Full mutation gates remain running.
- 10-29 00:26 CDT codex-nostr-codecs: Current untrusted claims projection passed its full default-budget mutation gate: 1655/1655 killed, zero survivors and no waivers. Selector, semantic candidate and local original-JWS closure gates remain running; trusted provider, policy identity and fresh NIP-42 remain absent.
- 10-29 00:30 CDT codex-nostr-codecs: Host-first selector first mutation killed 1668/1669; the single second-parse/status survivor was not waived. The status/issuer conjunction now has direct checks and independent delta review; 173/175/249 Coax checks and 13/20/27 native/Wasm/ASan cases pass. Selector, semantic and local-JWS full mutation gates are running.

## Ready (11)

### #57b3 Physical-device and frame-tail budgets

status open · ready · size M · labels r0, perf, ios · milestone #6f40 R0: the adoption gate

Event: `57b3bc4877bf63ea786de351f3616835ffce903546500fda8bdeefc38457fc5f`

Agree a frame-tail budget, then measure the Coax kernels on a named phone: CPU time, tails, copies, allocations and GPU upload, with raw results and dispersion retained.

Roadmap: coax/ROADMAP.md.

## Acceptance

- A tail budget is written down before optimizing
- Device runs retained with dispersion; the owner's device step is in NEEDS_OWNER.md

### #d383 Attribute the whole clean and warm development loop

status open · ready · size M · labels r0, perf, tooling · milestone #6f40 R0: the adoption gate

Event: `d3838817c77b34f32eb9006479c4cebb108e1c73a327b8d602da0ba436e8ded2`

Load/parse/check, compile-time work, generation, C compilation, link, assets, launch and GPU preparation; generated C size and peak compiler memory.

Roadmap: coax/ROADMAP.md.

## Acceptance

- A report attributes every stage for clean and warm builds
- The largest bottleneck is named with its numbers

### #9d2e Independently enforced review of invariants, oracles and gates

status open · ready · size M · labels r0, policy · milestone #6f40 R0: the adoption gate

Event: `9d2e29f53d1ab109714ebaa9f38cf47c8fcbd14c51218099511930f244ecfa54`

Define who reviews changes to invariants, oracles and verification policy, enforced outside the compiler on owned infrastructure, including moves into unmarked helpers.

Roadmap: coax/ROADMAP.md.

## Acceptance

- The policy is written and enforced by a check outside the compiler
- A change that weakens a check and its code together is refused without review

### #c296 Pin semantic profiles: checked, wrapping and optimization kept apart

status open · ready · size M · labels r0, semantics · milestone #6f40 R0: the adoption gate

Event: `c296d48f949f9decc5f96333e8d34b113ff066c08a40fbb51af21223c00fdaff`

A versioned design and migration for checked arithmetic with explicit wrapping, profile metadata in artifacts and cache keys, and same-profile unoptimized/optimized conformance vectors (overflow, casts, shifts, division edges, evaluation order, cleanup, f32 literal rounding).

Roadmap: coax/ROADMAP.md.

## Acceptance

- Profiles recorded in artifact metadata
- Conformance vectors pass in both optimization levels

### #3c97 One versioned evidence record for checks and mutation

status open · ready · size S · labels r0, tooling · milestone #6f40 R0: the adoption gate

Event: `3c97013cfd742dccd08ffc61f5ef2987590d2bcf3d27a35a3fb228ca00303f57`

Every claim bound to source, compiler, target, profile, selection and budgets, with outcomes passed, counterexample, inconclusive, infrastructure error and not checked.

Roadmap: coax/ROADMAP.md.

## Acceptance

- coax test and coax mutate write the record
- Missing execution is never a pass

### #94a3 Constant-time fixed-base multiplication k·G

status open · ready · size L · labels crypto, secp256k1 · milestone #3021 Signing and ECDH

Waits on: #8ee9 Points: affine and Jacobian add, double and mixed add (resolved); #0bd1 A dudect-style constant-time timing harness (resolved); #0af2 Enforce the supported secret-path and variable-time boundary (resolved); #79d5 Analyze actual crypto aggregate paths and guard obligations (resolved); #7287 Bounded compile-time work inputs for generated crypto tables (resolved)

Event: `94a3347135a6feb30e2745a0f244f338d986842dfe4c34cb95280fd38899d34f`

Plan (5 of 5 done, updated 10-28 22:58 CDT by codex-nostr-profiles):

- [x] Measure actual #run generation/work/size budgets and choose an honest fixed-work table schedule while preserving the public variable-time module
- [x] Implement Coax fixed-base scalar multiplication and full-scan selection with checked boundary behavior
- [x] Compare 100000 random and boundary scalars against independent libsecp on native and Wasm, with sanitizer coverage
- [x] Close scoped mutation and the declared native timing profile; retain exact table/stack and unresolved guard/object/JIT/production gates for review
- [x] Wait for #7287 resolution, then verify the published commit and close the task

Comb method with a table generated by #run (32 KB variant for the page, 64 KB native); every lookup through ge_table_select; no secret branches.

## Acceptance

- 100000 random scalars and boundary scalars match the independent oracle
- Record actual table-generation budget and emitted table/stack size
- Timing probe reports no detected leakage for the declared native profile; generated-code audit remains separate

## Files

- `coax/lib/crypto/secp_mult.coax`

Notes:

- 10-28 21:42 CDT codex-nostr-profiles: Budget finding: frozen coax0 0.16.0 refuses even #run sg_double_valid(sg_generator()) at its unchanged aggregate 100000-step limit (E0400 in secp_field.coax:221). A real full Coax comb-table generator therefore needs a separately reviewed bounded #run build-input profile; no baked table, renamed runtime initialization, check-budget waiver, or production-secret approval will substitute. I am measuring pure public generator fixtures with coax test --steps as cost probes only. Proposed tables use 128 Jacobian points (30720 bytes, width 7/spacing 37) for the page and 256 points (61440 bytes, width 8/spacing 32) for native. Both actual #run tables remain required before this task closes. The claim release aa7834d6cc failed two staging goldens; production untouched, no blind retry.
- 10-28 21:56 CDT codex-nostr-profiles: Public generator cost probes: web63,698,174 steps; native103,614,101 (including assertions). Taskmaster selected separate explicit --run-steps250000000 profile with100000 default and check/mutation limits unchanged. Actual #run wrappers now exist and still correctly refuse under default100000 until that compiler prerequisite ships. Internal generated-table-only selector scans every entry using opaque equality masks and XOR/AND choices; arbitrary external points are not admitted.70 default-budget check groups pass, and measured complete online work is below20M for both variants. Mutation closure is running; real compiled-table/libsecp/native/Wasm/timing acceptance remains pending.
- 10-28 21:59 CDT codex-nostr-profiles: Preliminary runtime-generated public-table probes passed: all 128 web and 256 native entries plus 1515 boundary/seeded scalars per profile against a separate affine arithmetic oracle; wasm32/WASI Node passed 728 profile comparisons across 364 scalar cases with limb, infinity and output guards. These do not substitute for actual #run tables, the independent libsecp 100000-scalar acceptance, or timing. Core mutation is running; #7287 remains the compilation prerequisite.
- 10-28 22:00 CDT codex-nostr-profiles: A preliminary runtime-table native ASan/UBSan probe also passed all 256 single-bit scalars, with valid and equal web/native points. Reproduction artifacts are retained under /tmp/coax-fixed-base-runtime-* on this host; they are not actual #run or production-secret evidence.
- 10-28 22:02 CDT codex-nostr-profiles: Timing acquisition compiles with a temporary runtime-table adapter. Preliminary one-million-observation controls classified fixed-work as no detected difference (t=0.81) and the planted branch as detected (t=-319.64), with independent recomputation agreeing. This checks the harness only, not fixed-base leakage or acceptance; raw control data remain under /tmp/coax-fixed-base-timing-control-* on this host.
- 10-28 22:07 CDT codex-nostr-profiles: Provisional bounded compiler generated both actual #run tables; checked/release native smoke compared all 768 table-mode entries and 517 boundary scalars per profile/mode to pinned libsecp and passed sanitizer checks. The first Wasm run trapped with the default stack; the checked/release rerun passed after setting the test linker stack to 1 MiB. Native O2 wrapper frames were 30800/61520 bytes plus nested calls. Final compiler resource tests, 100000-scalar runs, full target stack decisions, mutation and timing remain open.
- 10-28 22:11 CDT codex-nostr-profiles: Core mutation found four survivors (1164/1168 killed): width admission at 8/9 was masked by length checks and the selector did not test a non-infinity first entry. Added an independent pure profile-boundary check and a first-entry selection check; 72/72 core checks pass. Mutation is rerunning; no zero-survivor claim yet.
- 10-28 22:23 CDT codex-nostr-profiles: Resource-tested compiler SHA-256 4942904896b469e77840506319d5f1d09b5a35016a5c63f66fac6a022d0cbde0 passed full actual-table correctness: 100000 seeded scalars plus 517 boundaries per profile on checked/release native and Wasm, all 768 table-mode entries versus pinned libsecp, sanitizer and guards. Combined #run used 166665133 of 250000000 steps; tracked peaks were 38376 slots and 7264 containers. Wasm test stack is explicitly 1 MiB; production host stack and compiler full bootstrap remain open. Mutation and native timing are running.
- 10-28 22:26 CDT codex-nostr-profiles: The strengthened core mutation rerun killed all 1168 mutants with zero survivors. Web and native wrapper mutations and the declared native timing profile remain running; no production-secret or object/JIT approval is inferred.
- 10-28 22:27 CDT codex-nostr-profiles: Prepared local unpushed preliminary source-and-correctness snapshot c30c817be7ed393040ca4b390ba2a0db2dabb672 for taskmaster review; all recorded source hashes revalidated. It is not a completion link: both wrapper mutation gates and native timing remain running, and the compiler bootstrap is separately pending.
- 10-28 22:31 CDT codex-nostr-profiles: Declared native timing passed on the pinned compiler with 1000000 observations per fixture: page t=0.6782, native t=0.4432, fixed control t=-1.0664 (no detected difference), planted branch t=-345.4044 (detected); independent recomputation agrees. Raw observations and binary are retained in the worktree ignored timing directory. This is a scoped first-order experiment, not a constant-time or production-secret approval. Both wrapper mutation gates remain running.
- 10-28 22:37 CDT codex-nostr-profiles: Initial wrapper mutation found three profile-argument survivors (native 1171/1173, page 1172/1173). Explicit checked profile accessors were added; both revised wrapper suites pass 75/75, and focused actual-table/native/Wasm oracle and sanitizer checks pass on the revised source. Both wrapper mutations and a timing experiment on that changed source are running; the earlier full correctness and timing reports remain pinned to their prior source hashes.
- 10-28 22:40 CDT codex-nostr-profiles: The revised wrapper accessors change emitted objects, so the full 100000-scalar native/Wasm oracle run and declared timing experiment are running again on the changed source. This is affected-source verification, not a rerun for unrelated main changes. Earlier reports remain retained with their own exact source and compiler hashes.
- 10-28 22:46 CDT codex-nostr-profiles: Declared timing on revised wrapper source passed with one million observations per fixture: page t=-0.5538, native t=0.0628, fixed control t=-1.2212 (no detected difference), planted branch t=-344.8153 (detected); independent recomputation agrees. Exact binary and raw observations retained under coax/bin/nostr-fixed-base-timing-profile-v2. This is scoped first-order evidence only. Full revised-source Wasm and both wrapper mutation reruns remain active.
- 10-28 22:46 CDT codex-nostr-profiles: Full correctness on revised wrapper source passed all five tests: 100000 random scalars per profile/mode plus 517 boundaries in checked/release native and Wasm, all 768 generated table-mode entries versus pinned libsecp, sanitizers and guards. The separate report pins revised source/compiler/artifact hashes; revised timing also passed. Both wrapper mutation reruns remain active.
- 10-28 22:49 CDT codex-nostr-profiles: Correction to the earlier resource note: the reported 38376 slots and 7264 containers are frontend-evaluation peaks sampled before authority checks, not peaks for the whole compiler invocation. Evaluated-step and source/compiler provenance are unchanged.
- 10-28 22:56 CDT codex-nostr-profiles: Reviewed source and evidence are published on main as 9df181a55b409561f014a325cb61c215b0433116; its ancestry and all revised source hashes were verified. Core mutation killed 1168/1168 and each wrapper killed 1173/1173. Full 100000-scalar native/Wasm correctness and revised native timing passed under pinned compiler provenance. The task remains open until #7287 resolves; guard/object/JIT/security and production-secret approval remain separate.
- 10-28 22:58 CDT codex-nostr-profiles: Done in 9df181a55b: https://github.com/OpenAgentsInc/openagents/commit/9df181a55b409561f014a325cb61c215b0433116
- 10-28 23:24 CDT codex-nostr-profiles: Done release d20a426835 failed the staging Haunted House golden (104 changed blocks, 6 allowed); production was untouched. The taskmaster identified the expected VOICE hotbar change and queued a fresh normal release after committing its reviewed golden. No bypass or blind retry was used.
- 10-28 23:56 CDT codex-nostr-profiles: Reopened for source-scope revalidation because prerequisite #79d5 has a confirmed false-acceptance case. The existing oracle, mutation and timing results remain valid for their pinned inputs, but they do not resolve the affected source-audit assurance or approve production secrets.
- 10-28 23:57 CDT codex-nostr-profiles: Reopened pending #79d5 after the aggregate auditor was shown to admit a stale by-value literal and skip an actually reachable variable-time call. The arithmetic, oracle, mutation and timing evidence remains scoped and retained; prior source-admission evidence requires revalidation. Releasing the resurrected claim while repairing #79d5.

### #0e58 Optional NIP-49 KDF, cipher and normalization primitives

status open · ready · size M · labels nostr, coax · milestone #ea3f Optional encrypted key backup

Waits on: #5fc9 ChaCha20 block function and stream cipher (resolved); #89fb Secure erasure and bounded secret-copy contract (resolved); #0e80 A native vector runner for Coax crypto modules (resolved)

Event: `0e5853c814759a5d56136a7862b8bce10e1d2cd446ba52c642f1dddf0f6a107f`

scrypt/Salsa20/8, HChaCha20/XChaCha20 and Poly1305 plus exact NFKC normalization contract, bounded memory/work and erasure. Only required for the optional encrypted-backup profile.

## Acceptance

- Independent vectors and normalization cases pass across advertised native/iOS/Wasm targets
- Untrusted memory/KDF parameters refuse within declared budget; error paths wipe buffers

## Files

- `coax/lib/crypto/`
- `coax/tests/vectors/`
- `tools/coax-nostr/`

### #0d37 Send email from the API service through Resend

status open · ready · size M · labels services, email · milestone #2985 A daily digest by email and on paper

Event: `0d372e4ae1c83be2357f56f5942ed6234613df83030075ec445d6c3d50510cba`

oa-api sends email through Resend (https://api.resend.com/emails) from `OpenAgents <no-reply@openagents.com>`, with the key from Secret Manager `openagents-resend-api-key` (the same secret the old Rust service used, crates/openagents-web/src/cloud/magic_email.rs before the reset). HTML and plain-text bodies, attachments, an idempotency key per message, retries with backoff, a send log without bodies, and a List-Unsubscribe header. Staging sends only to an allowlist.

Design: `docs/coaxial-services.md`.

## Acceptance

- A test email with a PDF attachment reaches the owner from staging
- A repeated send with the same idempotency key delivers once
- No key, address list or body appears in logs

## Files

- `coax/web/api/`

### #a145 Morning schedules: Cloud Scheduler calls the API at a local time

status open · ready · size S · labels services, schedules · milestone #2985 A daily digest by email and on paper

Event: `a145b34cfe90063405e6b02c0b15c93f7e3118da75a705b92728bd4f23f89e3d`

Authenticated scheduled jobs: Cloud Scheduler (time zone America/Chicago, so daylight saving is handled) calls an oa-api job endpoint with an OIDC token; the endpoint refuses anything else. Jobs are idempotent per day, and a missed run can be re-run by hand.

Design: `docs/coaxial-services.md`.

## Acceptance

- A job set for 7:00 Chicago runs at 7:00 on both sides of the November 1 daylight-saving change in a dry run
- An unauthenticated call to the job endpoint is refused

## Files

- `coax/web/api/`

### #f96d Link Coax into the API service

status open · ready · size M · labels services, coax · milestone #2985 A daily digest by email and on paper

Event: `f96d816de92263a8fe6b16538221f8212b549247728a2cddbae9bd9ea53cbfff`

Coax emits C, and oa-api is C: build Coax modules into the service so server-side layout (the email, the PDF) runs the same Coax code as the page. A small C bridge, the build in the API's Dockerfile, and coax tests in the API's test run.

Design: `docs/coaxial-services.md`.

## Acceptance

- oa-api calls a Coax function and its result is checked by a test
- The Docker build compiles the Coax modules from source

## Files

- `coax/web/api/`

### #7486 Sprints, backlog, stretch goals and a priority-change log for private projects

status open · ready · size M · labels services, projects · milestone #2985 A daily digest by email and on paper

Event: `7486825ede331437f852858ac700f110b3ae4344854ed6d51657f0c5b26ff87d`

Extend openagents.private-project.v1: sprints (goal, dates, who agreed, review and retro notes), an ordered backlog, stretch and carried-over milestones, done-with-evidence, a log of priority changes (what, why, proposed by, agreed by), and a limit on work in progress. Agent keys may add proposals but not change a sprint goal.

Design: `docs/coaxial-services.md`.

## Acceptance

- Schema documented and validated on push
- An agent push that changes a sprint goal is refused

## Files

- `coax/web/api/`

## Waiting (69)

### #ccba Run eligible checks on emitted native code

status open · size M · labels r0, testing · milestone #6f40 R0: the adoption gate

Waits on: #c296 Pin semantic profiles: checked, wrapping and optimization kept apart (open)

Event: `ccba52ff7f1b14e8beb1f74deef63ab443c5dfe4fd80deab1369bc5cb45b8446`

An optional native check executable runs pinned inputs through the evaluator and the emitted unoptimized and optimized procedures and compares values, traps and buffer writes.

Roadmap: coax/ROADMAP.md.

## Acceptance

- Seeded evaluator/emitter defects are caught
- Mismatches minimised and kept as regressions

### #f535 A frozen authoring-task corpus for agents

status open · size S · labels r0, agents · milestone #6f40 R0: the adoption gate

Waits on: #3c97 One versioned evidence record for checks and mutation (open)

Event: `f53502bac1b51795d1e3c859655a73d663418b065082d9881662add29ce18c6e`

Change a kernel, add a field, repair a type error, update a protocol adapter; pinned revisions, tools and budgets; measure accepted completion, repair iterations and edit-to-result time.

Roadmap: coax/ROADMAP.md.

## Acceptance

- Four tasks pinned with oracles agents can't edit
- A first run's numbers recorded

### #963b R1a: declaration identities, targets, spans and namespaces

status open · size L · labels r1, compiler · milestone #d98b R1: the compiler substrate

Waits on: #c296 Pin semantic profiles: checked, wrapping and optimization kept apart (open)

Event: `963ba9fc751a7e575ad782f6635f6bcafca01bd3b5567d4990f3b95e6385cecb`

Declaration and content identities, explicit target descriptions, original spans, basic namespaces and minimal inspectable procedure lowering, pinned with differential fixtures and independent oracles.

Roadmap: coax/ROADMAP.md.

## Acceptance

- Differential fixtures pass against independent oracles

### #ca69 R7a: a formatter and evidence tools on current APIs

status open · size M · labels r7, tooling · milestone #a989 R7: workspaces, plugins and tooling

Waits on: #3c97 One versioned evidence record for checks and mutation (open)

Event: `ca69f93a896a77f083747dc30d49d5de3420f174748ced153f5ed6aafd9b5ccd`

coax fmt and evidence reporting using today's compiler APIs; typed queries and revision-bound fixes follow R1a.

Roadmap: coax/ROADMAP.md.

## Acceptance

- coax fmt is idempotent over the repository's Coax files

### #6541 R2a: tagged results, optionals and exhaustive switching

status open · size L · labels r2, language · milestone #08f5 R2: fallible application code

Waits on: #963b R1a: declaration identities, targets, spans and namespaces (open)

Event: `6541812581360075e6a12e196f4773d4ab5c4a90b39a409098eb60f916833c80`

Typed results and optionals, exhaustive switch, propagation and exhaustive cleanup, with one real asynchronous adapter.

Roadmap: coax/ROADMAP.md.

## Acceptance

- The spec's R2a examples compile and their checks pass

### #76ba R4a: generic copyable values over fixed storage

status open · size L · labels r4, language · milestone #a0eb R4: generics and foundational libraries

Waits on: #963b R1a: declaration identities, targets, spans and namespaces (open)

Event: `76bad4951d0c2dc57eda7e4522070c27e951ab21a06177f05f1c5f0368b273b7`

Generic copyable values and non-owning operations over fixed storage.

Roadmap: coax/ROADMAP.md.

### #791f R5a: derivation over concrete checked types

status open · size M · labels r5, language · milestone #265f R5: source-aware reflection and derivation

Waits on: #963b R1a: declaration identities, targets, spans and namespaces (open)

Event: `791f07997d9b98b2a86b2f3157fcd71db650fca9cfa838f634998d3bbc9d92ee`

Narrow derivation (equality, formatting, serialization) over concrete, already-checked types.

Roadmap: coax/ROADMAP.md.

### #0c13 R11a: replace a procedure body without relaunching (Mac experiment)

status open · size M · labels r11, tooling · milestone #3daf R11: resident compiler and transactional reload

Waits on: #963b R1a: declaration identities, targets, spans and namespaces (open)

Event: `0c13c6ed2696572356537f5a6b8340b3431a779cae2f96ae1bbb5df6f6f3f414`

The unchanged-layout Mac replacement experiment: swap a procedure body in a running app.

Roadmap: coax/ROADMAP.md.

### #6943 The page verifies one real event in Coax

status open · size S · labels web, nostr · milestone #415a Group arithmetic and Schnorr verify

Waits on: #7cdf NIP-01 events: parse, serialize IDs and verify (open)

Event: `69431a57b1c90581f1d71cbf5139e9413287fd9aefb0616548c3d7bed6f1333b`

Dev-only real-event probe using the actual shared canonical event reader/ID serializer/verifier, not a second minimal implementation. Baked public fixture, no signing or production key dependency.

## Acceptance

- ID/content/signature tampering and out-of-profile input show REFUSED; an independently verified real fixture shows VERIFIED
- Visuals check passes; no signing dependency in this task closure

## Files

- `apps/openagents-web/`

### #3e29 Constant-time variable-base multiplication k·P

status open · size M · labels crypto, secp256k1 · milestone #3021 Signing and ECDH

Waits on: #8ee9 Points: affine and Jacobian add, double and mixed add (resolved); #0bd1 A dudect-style constant-time timing harness (resolved); #0af2 Enforce the supported secret-path and variable-time boundary (resolved); #79d5 Analyze actual crypto aggregate paths and guard obligations (resolved); #f07b Analyze bounded public-loop crypto closures within finite audit work (open)

Event: `3e29fd0e72622bf43e24cd33daf0c6c457f4d81317111a98ee0707ffdf67c62b`

Plan (4 of 5 done, updated 10-28 23:48 CDT by codex-nostr-profiles):

- [x] Specify secret scalar and public peer admission, signed 4-bit recoding, and fixed-work masked schedule with boundary checks
- [x] Implement Coax variable-base multiplication while retaining the public variable-time module
- [x] Verify 100000 random scalar and peer pairs plus exceptional points against independent libsecp on native and Wasm
- [x] Close zero-survivor mutation and record scoped timing, source and target-review limitations
- [ ] **now:** Resolve the aggregate source-scope refusal and retain explicit authored-guard obligations before closing

A fixed-window (4-bit) constant-time multiplication for ECDH, with signed-digit recoding and masked table selection.

## Acceptance

- 100000 random scalar/peer pairs and exceptional points match
- Secret branches/indices are forbidden by the documented source scope; timing probe records methodology without claiming proof

## Files

- `coax/lib/crypto/secp_mult.coax`

Notes:

- 10-28 23:09 CDT codex-nostr-profiles: Claimed in fresh worktree after fixed-base closure. Source-scope and arithmetic checks will not be represented as generated-object review or production-secret approval. The claim release is queued after the active fixed-base release succeeds.
- 10-28 23:11 CDT codex-nostr-profiles: Initial full signed-radix16 multiplication exceeds the unchanged 20000000-step check budget: a public cost probe measured 53073965 steps; 64 doubles measured 7511275 and 64 complete adds 20057250. The normal full-path authored check therefore fails E0400. No waiver, partial-check substitute or production-secret claim is used; investigating efficient arithmetic while retaining the full positive-path requirement.
- 10-28 23:17 CDT codex-nostr-profiles: A candidate signed radix16 path using canonical 8x32 field/group kernels fits the full positive-path authored check at 19572458 steps under the unchanged 20000000 limit; 76/76 current checks pass. Preliminary independent field probes covered 11305 pairs and variable-base probes covered 1262 scalar/peer cases. Field mutation killed 244/244 after a constructed second-fold carry case; this is experimental, with group/whole-path mutation, full oracle, target timing and review still outstanding.
- 10-28 23:20 CDT codex-nostr-profiles: Aggregate source audit of the experimental smc_multiply closure refused at its existing 262144-node visit limit before completing dataflow analysis (9 reached procedures), and recorded a secret-derived authored assertion in existing sf_normalize. No source-flow, guard, object/JIT or production-secret approval is inferred; the full-scope audit remains open without a limit waiver.
- 10-28 23:24 CDT codex-nostr-profiles: The aggregate audit scalability follow-up is #f07b, published separately; it preserves the current limits and leaves authored secret-derived guards, generated-code review and production-secret approval unresolved. This task retains its original acceptance.
- 10-28 23:26 CDT codex-nostr-profiles: The experimental implementation passed the full independent oracle run: 100000 scalar/peer pairs per checked/release native mode and 100517 pairs per Wasm mode, plus raw boundary/exception checks, guards and sanitizers. A separate 2000 scaled-projective peer probe passed. A later authored test was added for distinct finite group addition after mutation exposed the gap; the prior full report retains its original source hash. Group and complete-path mutation remain running, and audit #f07b remains open.
- 10-28 23:29 CDT codex-nostr-profiles: Initial native timing on the pre-group-test source passed its declared first-order experiment: one million observations each, variable t=-1.8859, fixed control t=0.5860 (no detected differences), planted branch t=-331.5777 (detected); independent recomputation agreed. Raw observations and binary are retained locally. A separate run on the changed source is underway; this does not approve guards, object/JIT timing or production-secret use.
- 10-28 23:31 CDT codex-nostr-profiles: Independent read-only arithmetic review found no mathematical blocker under canonical 8x32 and bounded normalized-peer preconditions, while explicitly leaving secret-derived guards, target code and production use unapproved. Added a test-only non-infinity first selector entry; 80/80 authored checks pass. Earlier full oracle and timing reports retain their previous source hashes; mutation and final-source evidence remain open.
- 10-28 23:32 CDT codex-nostr-profiles: The strengthened canonical group32 checks killed all 1024/1024 mutants; field32 killed 244/244. Whole variable-base mutation remains running on the earlier source snapshot, and the current selector-first-entry test will require its own final gate. No secret-source, guard, target-code or production approval is implied.
- 10-28 23:39 CDT codex-nostr-profiles: Current-source native timing passed its declared first-order profile: one million observations each, variable t=-2.6796, fixed control t=-1.4354 (no detected differences), planted branch t=-285.6754 (detected), with independently recomputed statistics. Raw observations and binary are retained in coax/bin/nostr-variable-base-timing-v3. This is not secret guard, object/JIT or production approval; full mutation and aggregate audit remain open.
- 10-28 23:43 CDT codex-nostr-profiles: The scheduled full mutation pass killed 1334/1335; a first-window loop-bound mutation survived the earlier low-scalar checks. An independent bit255 full-path case was added and 81/81 checks pass under the unchanged limit. The current-source full mutation rerun is active with the validated scheduler and no exclusions. Full 100000-pair oracle and declared timing are being refreshed for the changed source; earlier reports remain retained.
- 10-28 23:50 CDT codex-nostr-profiles: Partial arithmetic and evidence snapshot is on main at f020e61b2c83c90fd212a035fdaa97e32082cfdc; it is not task completion or production approval. Current full correctness, 1335/1335 scheduled mutation, timing and independent arithmetic review passed within their documented scopes. Blocked on #f07b: aggregate source analysis refuses at 262144 visits; existing secret-derived authored guard obligations and target/object/JIT review remain unresolved. Acceptance is unchanged.

### #51f4 BIP-340 signing with auxiliary randomness

status open · size M · labels crypto, secp256k1 · milestone #3021 Signing and ECDH

Waits on: #94a3 Constant-time fixed-base multiplication k·G (open); #41bd BIP-340 Schnorr verification (resolved); #89fb Secure erasure and bounded secret-copy contract (resolved)

Event: `51f416c58a9c0b1b034d374a7fec805de9d9864211814cd792831113ab0f53a8`

General byte-view BIP-340 sign(message,seckey32,aux32), with a Nostr 32-byte wrapper. Validate 1<=key<n, parity normalization, auxiliary randomness, zero nonce refusal and final self-verification. Caller-owned bounded scratch and failure wiping; no partial signature released.

## Acceptance

- All official signing rows match byte for byte including non-32-byte messages
- Invalid/zero key, zero nonce and injected self-verification failure release no signature and wipe owned scratch
- Checked/optimized/native/Wasm results agree; timing is no-detected-leak evidence, not proof

## Files

- `coax/lib/crypto/schnorr.coax`

### #71e7 x-only ECDH shared secret

status open · size S · labels crypto, secp256k1 · milestone #3021 Signing and ECDH

Waits on: #3e29 Constant-time variable-base multiplication k·P (open); #89fb Secure erasure and bounded secret-copy contract (resolved)

Event: `71e7df5f2935d6e8e3a9cd8cbafcdd25b743b9064d891661fff41271a271de0f`

Validated raw shared x for NIP-44: refuse invalid peer points/scalars/infinity. The libsecp oracle must supply the raw-x callback; default secp256k1_ecdh hashes a compressed point and is the wrong oracle.

## Acceptance

- Official conversation-key and labelled adapted Wycheproof cases agree with independent raw-x computation
- Seeded use of the default libsecp hash callback is detected; error paths wipe scratch

## Files

- `coax/lib/crypto/ecdh.coax`

### #4878 NIP-44 version 2 encrypt and decrypt

status open · size M · labels nostr, crypto · milestone #ca06 NIP-44 and NIP-59

Waits on: #f20e HMAC-SHA256 and HKDF (resolved); #5fc9 ChaCha20 block function and stream cipher (resolved); #71e7 x-only ECDH shared secret (open); #5c3a Bounded hex and base64 codecs (resolved)

Event: `48783672d1a1652b41951c641f8331bcd3c574549b481196abb3251529dfb167`

Pinned NIP-44 v2 conversation/message keys, padding and ChaCha20/HMAC. MAC authenticates nonce||ciphertext before plaintext release; caller supplies fresh entropy. Support the six-byte prefix at >=65536 or explicitly refuse it under a named bounded profile. Outer event verification is mandatory at the signed-event integration boundary.

## Acceptance

- All upstream valid/invalid vectors and 65535/65536/65537 extended-prefix boundary fixtures pass or produce the advertised capacity refusal
- Wrong MAC/version/nonce/padding/alias/capacity never releases plaintext; zero surviving mutants
- Independent encrypt/decrypt interoperability in both directions, with no production key
- Every advertised payload maximum closes the real encrypt/base64/event-write/event-read/decrypt path, or refuses before emitting an event its selected reader cannot admit; raw-string, content, frame and crypto limits cannot silently disagree.

## Files

- `coax/lib/nostr/nip44.coax`

### #ef5a NIP-59 rumor, seal and gift wrap

status open · size M · labels nostr · milestone #ca06 NIP-44 and NIP-59

Waits on: #4878 NIP-44 version 2 encrypt and decrypt (open); #bab4 Build signed events over the verified event core (open)

Event: `ef5aa35ce36cfdd1bf6ed0c89e20ebaa292e896adedf1fb553e03c4f6204a432`

coax/lib/nostr/nip59.coax: build rumor (unsigned), seal (kind 13, signed by author, NIP-44 to recipient), wrap (kind 1059 from a fresh key, randomized created_at within two days back); unwrap verifies wrap sig, decrypts, verifies seal sig and that rumor pubkey equals seal pubkey.

## Acceptance

- Independent wrap/seal interoperability in both directions, including the existing test deck
- Reject altered outer signature, bad seal signature, rumor identity mismatch, missing recipient and oversized private payload
- Fresh wrap keys/nonces/timestamp policy and failure cleanup are covered

## Files

- `coax/lib/nostr/nip59.coax`

### #78f3 Open today's sealed deck natively with the Coax stack

status open · size S · labels nostr, tests · milestone #ca06 NIP-44 and NIP-59

Waits on: #ef5a NIP-59 rumor, seal and gift wrap (open); #fdce The 3188 artifact envelope (resolved)

Event: `78f3558f1975babb59910e79b424de75f48dd60a8154557f6531729820acb088`

A native test that fetches the sealed test deck's wrap fixture (checked in from the scratch e2e, test deck only), unwraps it with the recipient test key, checks the 3188 envelope digest and prints the slide titles.

## Acceptance

- Prints the two test-deck slide titles; digest matches

## Files

- `tools/coax-nostr/tests/`

### #9413 REQ filters: build and match locally

status open · size S · labels nostr · milestone #abf5 Events and encodings

Waits on: #7cdf NIP-01 events: parse, serialize IDs and verify (open)

Event: `941365238306bf0600e998a145f98b31010de2ce773b52cfee524c115b88b9e2`

coax/lib/nostr/filter.coax: ids, authors, kinds, #<tag>, since, until, limit; serialize to JSON and match an event locally (to drop events a relay shouldn't have sent).

## Acceptance

- #test matrix of filter × event matches NIP-01 semantics

## Files

- `coax/lib/nostr/filter.coax`

### #7de9 The relay client state machine

status open · size L · labels nostr · milestone #4d8f A relay client in the page

Waits on: #7cdf NIP-01 events: parse, serialize IDs and verify (open); #9413 REQ filters: build and match locally (open); #f426 NIP-42 AUTH events (open)

Event: `7de9620d9706743839185d429a0bdd1b25cd768c2d97d5f60025a697fda7475d`

Pure bounded verified client machine with connection/subscription generations, REQ/CLOSE/EVENT/OK/EOSE/CLOSED/NOTICE/AUTH, acknowledgement deadlines, cancellation, duplicate suppression and capped jittered reconnect. AUTH-required retry is once per authenticated generation. EOSE/short page never claims completeness; public reads need not wait for AUTH when the relay permits them.

## Acceptance

- Scripted transcripts cover ACK true/false/timeout, AUTH/reconnect, stale generations, duplicates, unknown subscriptions, queue overflow and forged events
- No host I/O inside Coax state machine; profile limits have clean refusal states

## Files

- `coax/lib/nostr/relay.coax`

### #f426 NIP-42 AUTH events

status open · size S · labels nostr · milestone #4d8f A relay client in the page

Waits on: #bab4 Build signed events over the verified event core (open)

Event: `f4268f9b58bbf38358880298462c5958b0cbb59dfefca02ecb6c5303e40d3fc2`

Bound kind22242 AUTH builder and signer handoff for current relay/challenge/connection generation. Proof of possession does not grant channel or host-operation authority.

## Acceptance

- Independent tags/signatures match; old challenge/relay/generation responses are refused

## Files

- `coax/lib/nostr/nip42.coax`

### #fd70 Key slots, storage records and the NIP-07 adapter

status open · size M · labels nostr, web · milestone #4d8f A relay client in the page

Waits on: #44fe Host import: IndexedDB bytes (resolved); #8ccd bech32 and NIP-19 entities (resolved); #6b36 Correlated local, NIP-07 and phone signer requests (open); #89fb Secure erasure and bounded secret-copy contract (resolved)

Event: `fd709fde9a20e47041f0fa1f491257a7c4bf832c527d10ac97a5149f7b2bfe13`

SecretSlot/forget and versioned key records. Prefer phone/NIP-46 or NIP-07 signer; explicit local browser slots are ephemeral by default. No new plaintext nsec IndexedDB persistence. Durable encrypted exports wait for the optional NIP-49 task; document legacy unlock-store migration.

## Acceptance

- Ephemeral slot import/forget and all error paths wipe bounded owned buffers; no key in logs/public state
- Returned signer output is correlated and verified for identity/body/scope
- Legacy storage migration/deletion failure states are explicit; no plaintext-persistence default

## Files

- `coax/lib/nostr/keys.coax`
- `coax/web/host.js`

### #4cca The page subscribes to relay.openagents.com with AUTH

status open · size M · labels web, nostr · milestone #4d8f A relay client in the page

Waits on: #7de9 The relay client state machine (open); #47b1 Host import: a WebSocket byte pipe (resolved); #d0d7 Host import: random bytes (resolved); #fd70 Key slots, storage records and the NIP-07 adapter (open)

Event: `4cca7f4d3f587b3796ead071adb8ce12e2673e186e7dcc8e25e2037f573289ea`

Wire host pipes and relay.coax into a probe page: connect, answer AUTH with a test key, subscribe to a known filter, draw verified event count and refusals.

## Acceptance

- Probe on staging shows the expected count from relay.openagents.com
- A REQ is never sent before AUTH completes (asserted from the outbox log)

## Files

- `apps/openagents-web/`

### #4a73 Open the hidden deck in Coax

status open · size M · labels web, nostr · milestone #6c0d Replace the TypeScript

Waits on: #4cca The page subscribes to relay.openagents.com with AUTH (open); #ef5a NIP-59 rumor, seal and gift wrap (open); #fdce The 3188 artifact envelope (resolved)

Event: `4a73354378a9e7058ca56491bb7de0bed6ea1d80d8be1f82c92b94e10d882bb3`

Replace coax/web/unlock/page.ts: fetch the wrap through relay.coax with AUTH as the recipient, unwrap with nip59.coax, check the envelope, hand slides to ui.coax.

## Acceptance

- The real phrase opens the deck on staging with page.ts removed
- Wrong key shows the key-wrong state

## Files

- `apps/openagents-web/`
- `coax/web/unlock/`

### #5d1a coax-nostr: a native CLI for keygen, seal, gate, publish and verify

status open · size L · labels tools, nostr · milestone #6c0d Replace the TypeScript

Waits on: #ef5a NIP-59 rumor, seal and gift wrap (open); #fdce The 3188 artifact envelope (resolved); #7de9 The relay client state machine (open); #da6b CSPRNG contract across native, iOS and browser (resolved); #51e6 The phrase gate in Coax, without AES (resolved)

Event: `5d1af539c7ef817a326f1ff314008ae905c72700d07d924d5cece537cdcb92dd`

tools/coax-nostr/: a native program built from the same modules: keygen, seal deck.md --author --to, gate (writes unlock entries for deploy.sh), publish (sign and send events to a relay with AUTH, using a small native socket), verify, fetch.

## Acceptance

- deploy.sh runs the gate step with coax-nostr and no bun
- Re-sealing the deck with coax-nostr opens on staging

## Files

- `tools/coax-nostr/`
- `coax/web/deploy.sh`

### #97b8 INVARIANTS: Coaxial pages draw and compute everything in Coax

status open · size S · labels policy, web · milestone #6c0d Replace the TypeScript

Waits on: #4a73 Open the hidden deck in Coax (open); #51e6 The phrase gate in Coax, without AES (resolved); #5d1a coax-nostr: a native CLI for keygen, seal, gate, publish and verify (open); #ce0b Publish the Coax project and its tasks as Nostr events (open); #0653 Reviewed production-secret rollout and recoverable retirement (open)

Event: `97b87d0491b6420da9185339e5705d2478124c6d588de6b13d6af23507a60ca7`

Change the INVARIANTS rule as coax/nostr.md §5 says, extend check-visuals.sh to refuse any page script besides host.js and any WebCrypto use, delete coax/web/unlock/, remove bun from deploy.

## Acceptance

- Every old crypto/tool consumer has a verified replacement and rollback evidence before deletion
- Check detects extra script/import/WebCrypto paths and seeded hidden dependency; coax/web/unlock retired only after cutover

## Files

- `INVARIANTS.md`
- `coax/web/check-visuals.sh`
- `coax/web/unlock/`

### #ce0b Publish the Coax project and its tasks as Nostr events

status open · size M · labels nostr, projects · milestone #5653 The project page goes live

Waits on: #5d1a coax-nostr: a native CLI for keygen, seal, gate, publish and verify (open)

Event: `ce0b851defc71422aea5845628d6f47c59b681505f712be0abf4766360a4c761`

Replace the already-working TS publisher with native Coax tooling. Preserve every existing issue ID/slug, signed revision/status/plan history and project order. First publication has already shipped; this task is implementation migration, not creating duplicate issues.

## Acceptance

- Readback signatures/IDs/fields agree with current publisher; existing issue IDs do not change
- Second publish emits nothing; comments/plans/resolved states survive migration

## Files

- `tools/coax-nostr/`
- `apps/openagents-web/projects/coax/work/`

### #4356 Claim a task from the page with a signed event

status open · size M · labels web, projects, nostr · milestone #5653 The project page goes live

Waits on: #c969 The live project page verifies every event in Coax (open); #6b36 Correlated local, NIP-07 and phone signer requests (open); #1df7 Authenticated worker claims with atomic resources and fences (open); #2154 NIP-98 session expiry, revocation and CSRF policy (open)

Event: `43563f5c9dbec79366f79a97141cb22c4561f83944616eab350e3996dfb14cc5`

A signed-in authenticated worker requests an atomic COORD claim and displays its actual lease/fence. Existing project-key claim comments are informational history, not evidence of the worker identity. No claim before verified task state/admission.

## Acceptance

- Two workers race for overlapping resources: exactly one grant, the other clean refusal
- Renew/release/expiry and stale fence are tested; accepted claim appears on another browser within 5s

## Files

- `apps/openagents-web/`

### #cf05 GLV endomorphism for faster verification

status open · size M · labels crypto, secp256k1, performance · milestone #5653 The project page goes live

Waits on: #ff0f wNAF dual multiplication a·G + b·P for verification (resolved); #c969 The live project page verifies every event in Coax (open)

Event: `cf0533bafc8ef564549aa2cd792fb3d93db97e5c0631c3800c89c662a3253a0b`

Optional GLV scalar decomposition only after actual verification arithmetic and a verified real-page benchmark exist. Not a blocker for core integration.

## Acceptance

- One-hour differential fuzz is clean with retained evidence
- Record before/after Wasm verify distribution and size; accept optimization only with measured benefit

## Files

- `coax/lib/crypto/secp_mult.coax`

### #a812 The Coax Nostr library runs on iOS against the same vectors

status open · size M · labels mobile, ios, crypto · milestone #9680 Sign in to the website with your phone

Waits on: #51f4 BIP-340 signing with auxiliary randomness (open); #4878 NIP-44 version 2 encrypt and decrypt (open); #7cdf NIP-01 events: parse, serialize IDs and verify (open); #8ccd bech32 and NIP-19 entities (resolved); #da6b CSPRNG contract across native, iOS and browser (resolved)

Event: `a812bca96c91845e93b0908ca34b456ba0750da412501313b6c0358d2228a191`

Build the Coax Nostr modules (hashes, secp256k1, Schnorr, ECDH, NIP-44, events, bech32) as C for iOS arm64 and the simulator through the app's Generated/ build step, and run the shared vector files in the iOS test target. Report sign and verify times on a device.

## Acceptance

- Same BIP-340/NIP-44/event files pass via generated C on simulator and actual iOS arm64 when available
- Entropy/ABI/lifetime/alias/error tests and simulator timings recorded; physical-device evidence is separately recorded, never inferred

## Files

- `apps/openagents-ios/project.yml`
- `apps/openagents-ios/Tests/`

### #bde1 NIP-46 remote signer (bunker side) in Coax

status open · size L · labels nip46, crypto, mobile · milestone #9680 Sign in to the website with your phone

Waits on: #4878 NIP-44 version 2 encrypt and decrypt (open); #bab4 Build signed events over the verified event core (open); #7de9 The relay client state machine (open); #6b36 Correlated local, NIP-07 and phone signer requests (open)

Event: `bde19af6ec5d47fc841159be677d94f04b1002c837df352b2b949e15f1ffb99e`

NIP-46 bunker side with distinct client/remote-signer/user identities, one-use connect secret and correlated kind24133 requests. Semantic permissions include kind+target+operation/scope/expiry, not a blanket kind allowlist. Unsupported NIP-04 methods return explicit errors.

## Acceptance

- Independent client connect/get_public_key/sign_event/ping/nip44 round trips pass
- Wrong/reused secret, identity confusion, ungranted target/scope, replay and altered returned event are refused
- No production identity involved in development tests

## Files

- `coax/lib/nostr/nip46.coax`
- `coax/tests/nostr/`

### #cf39 NIP-46 client in the page

status open · size M · labels nip46, web · milestone #9680 Sign in to the website with your phone

Waits on: #bde1 NIP-46 remote signer (bunker side) in Coax (open); #4cca The page subscribes to relay.openagents.com with AUTH (open); #7c36 NIP-46 permissions, revocation and phone suspension (open)

Event: `cf3977ddddce49a1b04ca39289cb829a8f039848cd5c7961c961107f0935e4aa`

The page side of Nostr Connect: an ephemeral client key, the nostrconnect:// URI (relay, secret, perms, name, url), waiting for the signer's connect, then get_public_key and sign_event requests over the page's relay client.

## Acceptance

- In-memory independent client/signer round trips verify distinct signer/user keys and get_public_key
- Relay switching/logout, duplicate IDs, timeout and late response behavior are explicit; ephemeral key wiped on sign-out

## Files

- `coax/lib/nostr/nip46.coax`
- `apps/openagents-web/`

### #a1d8 Scan a sign-in code with the phone and approve

status open · size M · labels mobile, ios, nip46 · milestone #9680 Sign in to the website with your phone

Waits on: #bde1 NIP-46 remote signer (bunker side) in Coax (open); #bc0b The phone holds the user's Nostr key in the Keychain (resolved); #503d QR code encoder in Coax (resolved); #7c36 NIP-46 permissions, revocation and phone suspension (open)

Event: `a1d85392c1cdcda73b83d8c22b82c959267620ea119aac3408b4e077dc0b13d1`

The app's QR scanner recognises nostrconnect:// codes, shows the site and what it asks for in an approval sheet, and on approval runs the NIP-46 signer for that session; the session shows in Settings and can be ended there.

## Acceptance

- Fixture QR opens owner approval; untrusted site metadata cannot grant permission
- Deny/end-session/replay/suspension are tested; foreground resumption cannot approve an expired request

## Files

- `apps/openagents-ios/OpenAgents/`
- `apps/openagents-ios/Tests/`

### #0af1 The server verifies NIP-98 HTTP auth and issues a session

status open · size M · labels server, auth · milestone #9680 Sign in to the website with your phone

Waits on: #7cdf NIP-01 events: parse, serialize IDs and verify (open)

Event: `0af19f0b640e3bfc544a89722f0f5af6d9601dd5d2ebadbd28fccc54f8d7eac9`

A native Coax server route POST /auth/nostr takes a NIP-98 kind 27235 event (url, method, payload hash, created_at within 60 s, unused id), verifies it with the Coax verifier, and sets an HttpOnly, Secure, SameSite=Strict session cookie bound to the pubkey. Admin pubkeys come from config. No WorkOS.

## Acceptance

- Valid throwaway login accepted; wrong URL/method/body/time/signature rejected
- Replay reservation is atomic across workers and restart for the acceptance window
- Bounded request/replay parsing has deterministic refusal; no key material in cookie

## Files

- `coax/lib/nostr/nip98.coax`
- `tools/coax-nostr/server/`

### #c8dd openagents.com/signin: the QR and the signed-in state

status open · size M · labels web, auth · milestone #9680 Sign in to the website with your phone

Waits on: #cf39 NIP-46 client in the page (open); #503d QR code encoder in Coax (resolved); #2154 NIP-98 session expiry, revocation and CSRF policy (open)

Event: `c8ddf047e6f45e3cb209922826bd0a56284dbb200afff3c52b33cf566b927490`

A Coaxial page draws the QR (HUD, Filament), waits for the phone, then asks it to sign the NIP-98 event and posts it to /auth/nostr. Shows who is signed in (npub, short) and sign out. Plain text in the hidden main for agents.

## Acceptance

- Actual browser waiting/denied/signed-in/signed-out states pass with throwaway phone signer
- User private key never enters browser memory; returned signatures are independently verified; visuals pass

## Files

- `apps/openagents-web/`
- `coax/tests/nostr/`

### #73ce End to end: sign in to openagents.com with the phone

status open · size M · labels mobile, web, auth · milestone #9680 Sign in to the website with your phone

Waits on: #a1d8 Scan a sign-in code with the phone and approve (open); #c8dd openagents.com/signin: the QR and the signed-in state (open); #2154 NIP-98 session expiry, revocation and CSRF policy (open)

Event: `73ce5c1cdf68fecacb68149159896ca1d245fe253597cde984cc61a0310aa7c4`

The deliverable test: the iOS simulator scans the QR shown by the page (fixture image of the live page's code), approves, and the page reaches the signed-in state with the server session bound to the phone's pubkey. Device run is an owner step in NEEDS_OWNER.md.

## Acceptance

- Simulator plus browser and local relay/server pass happy path, refusal, replay and sign-out
- Staging sign-in uses throwaway identity and exact origin/session binding
- Physical-device approval/background evidence goes to NEEDS_OWNER.md; real identity requires production cutover

## Files

- `apps/openagents-ios/Tests/`
- `coax/tests/nostr/`
- `docs/verification/`

### #c969 The live project page verifies every event in Coax

status open · size M · labels web, crypto, nostr · milestone #5653 The project page goes live

Waits on: #c29a /project/coax reads its project, tasks and order from the relay (resolved); #7cdf NIP-01 events: parse, serialize IDs and verify (open); #db36 Complete bounded live catch-up across relay caps (resolved)

Event: `c96951910dfb701627c5e9888c5265343c262f128b2471853a440fd3dc487aee`

Verify each live event ID/signature and author/project scope in Coax before verified folding/storage. Bound pending work and spend <=4ms/frame; refuse/count forged events. Production verified mode consumes no relay-trusted provisional rows and has no signing/keys/AUTH dependency.

## Acceptance

- A forged event via test relay never enters verified rows or downstream decisions; refusal/pending counts are visible
- Signed project changes show in verified rows without release, with explicit incomplete/offline states
- Actual Wasm browser transcript agrees with independent TS fold after verification

## Files

- `apps/openagents-web/project.coax`

### #bab4 Build signed events over the verified event core

status open · size M · labels nostr, coax · milestone #abf5 Events and encodings

Waits on: #7cdf NIP-01 events: parse, serialize IDs and verify (open); #51f4 BIP-340 signing with auxiliary randomness (open)

Event: `bab4ebdf1885f4daff16134a84746e75069c4ec059599aeca0ed36d81fd31c99`

Separate event building/signing from nostr-event read-only verification. Caller provides explicit aux/nonce entropy; bind identity/body/preimage and verify produced signature before release. No browser-host dependency in pure module.

## Acceptance

- 10000 independent signed-event round trips agree including Unicode and empty fields
- Bad signer output, invalid key and partial failure release no event or secret scratch

## Files

- `coax/lib/nostr/event.coax`
- `coax/tests/nostr/`

### #6b36 Correlated local, NIP-07 and phone signer requests

status open · size M · labels nostr, coax · milestone #7d06 Durable clients and signer interfaces

Waits on: #bab4 Build signed events over the verified event core (open); #f960 Named support profiles, limits and source evidence (resolved)

Event: `6b36d582af76c4241292a79c9d6ea62bf1e5769a8e0e89b0369261e9120ab3ac`

Shared signer request/result/cancel contract with requested identity/body/target/scope, bounded IDs/deadlines, verified output and explicit approvals. Pure decisions with thin NIP-07 effect adapter; supports test keys before production approval.

## Acceptance

- Independent/fake signer output tampering, wrong identity/body, duplicate/late replies and denial are refused
- Local test slot and NIP-07 adapter implement same bounded lifecycle; no default persistent browser nsec

## Files

- `coax/lib/nostr/keys.coax`
- `coax/web/host.js`
- `coax/tests/nostr/`

### #f116 One vector corpus on native, Wasm and iOS

status open · size M · labels nostr, coax · milestone #ceadf Profiles, assurance and production gates

Waits on: #0e80 A native vector runner for Coax crypto modules (resolved); #bab4 Build signed events over the verified event core (open); #4878 NIP-44 version 2 encrypt and decrypt (open); #ef5a NIP-59 rumor, seal and gift wrap (open); #a812 The Coax Nostr library runs on iOS against the same vectors (open); #4747 PBKDF2-HMAC-SHA256 (resolved)

Event: `f11651a6e6639b11287973949ffd2df6240d2b17b9f836c379b3c564404466a1`

Execute the same pinned full-vector corpus and malformed-input cases through actual emitted checked/optimized C, Chrome/Safari/Firefox Wasm and iOS C ABI. Device unavailable is an explicit owner step, not silently passed.

## Acceptance

- Artifact/input hashes and per-target results agree; seeded wrong output is detected
- Simulator and physical-device results are separate; missing required targets prevent cutover

## Files

- `tools/coax-nostr/vectors.sh`
- `coax/tests/nostr/`
- `apps/openagents-ios/Tests/`
- `docs/verification/`

### #8d2f Inspect secret-path lowering on real targets

status open · size M · labels nostr, coax · milestone #ceadf Profiles, assurance and production gates

Waits on: #51f4 BIP-340 signing with auxiliary randomness (open); #71e7 x-only ECDH shared secret (open); #4878 NIP-44 version 2 encrypt and decrypt (open); #89fb Secure erasure and bounded secret-copy contract (resolved); #0af2 Enforce the supported secret-path and variable-time boundary (resolved); #79d5 Analyze actual crypto aggregate paths and guard obligations (resolved)

Event: `8d2ff95ec55aa83a06787d8a6b4539b66ab9376ef370f086271eba8e0284e01d`

Audit generated objects for scalar multiplication, sign, ECDH, MAC compare and erasure across arm64/x86-64 and wasm profiles. Pin compiler/toolchain/flags/LTO/artifact hashes; browser JIT results are bounded observations.

## Acceptance

- Seeded branch/index/removed-wipe faults fail the inspection pipeline
- Target/profile reports identify unsupported claims and record real browser execution

## Files

- `tools/coax-nostr/codegen/`
- `docs/verification/`

### #4163 Independent review before production cryptography

status open · size L · labels nostr, coax · milestone #ceadf Profiles, assurance and production gates

Waits on: #f116 One vector corpus on native, Wasm and iOS (open); #8d2f Inspect secret-path lowering on real targets (open); #0bd1 A dudect-style constant-time timing harness (resolved)

Event: `4163241dc173e0d4928a42d2a311d4f7f24d5f826d546de53166bfa75f7381fc`

Independent reviewers assess arithmetic bounds, group exceptions, nonce/signing, serialization, protocols, erasure and compiler/host boundaries. Resolve findings and pin exact reviewed source/artifact evidence. Self-review and mutation/timing scores are not substitutes.

## Acceptance

- Review report names independent reviewers and reviewed hashes; no unresolved blocking findings
- Changing reviewed crypto/compiler/ABI inputs invalidates the affected approval rather than silently inheriting it

## Files

- `docs/verification/`
- `coax/nostr.md`

### #7c36 NIP-46 permissions, revocation and phone suspension

status open · size M · labels nostr, coax · milestone #9680 Sign in to the website with your phone

Waits on: #bde1 NIP-46 remote signer (bunker side) in Coax (open)

Event: `7c36f2ad5989e170e4f0ad16d4364d26552f425e1c1d8a2901ade823b702bcc5`

Bound semantic method/kind/target/scope permissions, replay/correlation, one-use connect, switch_relays/logout, denial/expiry, foreground approval and suspended-phone timeout. Client/signer/user identities remain distinct.

## Acceptance

- Independent transcript tests cover reused secret, revoked permission, replay, switched relay and logout
- Suspension/resume/late approval cannot sign an expired or differently scoped request

## Files

- `coax/lib/nostr/nip46.coax`
- `apps/openagents-ios/Tests/`
- `coax/tests/nostr/`

### #2154 NIP-98 session expiry, revocation and CSRF policy

status open · size M · labels nostr, coax · milestone #9680 Sign in to the website with your phone

Waits on: #0af1 The server verifies NIP-98 HTTP auth and issues a session (open)

Event: `21546dbf32d4baa077745f367e0479403200f9fd9a7818cd6ccbbb28c11f77b4`

Complete production HTTP sessions after signed login: atomic replay window across restarts/workers, fixation/CSRF policy, scoped roles, cookie rotation, expiry, logout/revocation and cleanup. Login does not imply administration.

## Acceptance

- Concurrent replay accepts once; restart within window cannot replay
- Wrong-origin/CSRF/fixation/stale cookie and revoked role fail; valid sign-out removes authorization

## Files

- `coax/lib/nostr/nip98.coax`
- `tools/coax-nostr/server/`
- `coax/tests/nostr/`

### #0653 Reviewed production-secret rollout and recoverable retirement

status open · size L · labels nostr, coax · milestone #ceadf Profiles, assurance and production gates

Waits on: #4163 Independent review before production cryptography (open); #73ce End to end: sign in to openagents.com with the phone (open); #c969 The live project page verifies every event in Coax (open); #78f3 Open today's sealed deck natively with the Coax stack (open); #51e6 The phrase gate in Coax, without AES (resolved)

Event: `06535d9a588f918825cfdc1933bdb04889463f38afd9c9536dd9c98f992dbaac`

Gate production identities and removal of working paths on independent review, required target/device evidence, real consumer tests, versioned migration flags and rollback. Test-key development remains unblocked; production identity is never silently introduced.

## Acceptance

- Reviewed source/artifact identities, required owner evidence and staged real-consumer results are pinned
- Rollout/rollback is exercised and changed trusted inputs invalidate affected approvals
- No self-approved review or unavailable target is counted as passed

## Files

- `docs/verification/`
- `coax/nostr.md`
- `coax/web/deploy.sh`

### #2ff9 Source-preserving Coax proto and domain adapters

status open · size M · labels nostr, coax · milestone #100a Real Coax domain adapters

Waits on: #7cdf NIP-01 events: parse, serialize IDs and verify (open); #f960 Named support profiles, limits and source evidence (resolved)

Event: `2ff91a54d334072f24d53f39ff1b9f5583227e6d28ae8436a1dca3d7a8a8ab49`

Use existing generated root proto codecs in real domains; preserve original Nostr/JWS/HOST bytes, compare projections and enforce bounds/presence/unknown policy. DTOs grant no authority and protobuf bytes never replace signature preimages.

## Acceptance

- Actual source fixtures round-trip original bytes through generated codecs; mismatched projections refuse
- Policy tests show decoded owner/verified-like unknown flags cannot authorize an effect

## Files

- `coax/lib/nostr/adapters/`
- `proto/nostr/`
- `proto/tools/`
- `coax/tests/nostr/`

### #d742 HOST invitation and grant admission before effects

status open · size M · labels nostr, coax · milestone #5a3f HOST, REACH and real delegated work

Waits on: #2ff9 Source-preserving Coax proto and domain adapters (open); #bab4 Build signed events over the verified event core (open); #bd06 Selected JWS crypto and exact assertion verification (open)

Event: `d742c2c16829b44d4b0a55f1ccd2f718f0b43200fa56ac73467b07cb8d93b81c`

Verify original signed invitations/grants with explicit selected signature/JOSE profile; issuer/audience/host/operation scope, redemption, expiry, revocation epochs and replay. No relay/tailnet membership substitutes for grant authority. Its JOSE allowlist is explicitly selected and reviewed, not inferred from FI or Nostr key possession.

## Acceptance

- Wrong host/audience/scope, expired/revoked/replayed grant and unavailable policy refuse before effect
- A valid least-privilege throwaway grant admits one bounded operation; original evidence is retained

## Files

- `coax/lib/nostr/host/`
- `proto/openagents/host/`
- `nips/openagents/NIP-HOST.md`

### #62d9 Block OA owner proofs and AA agent membership

status open · size M · labels nostr, coax · milestone #7cbf Block ownership and federated identity

Waits on: #2ff9 Source-preserving Coax proto and domain adapters (open); #f426 NIP-42 AUTH events (open)

Event: `62d9ab1a2b0592cc24cbb1038fd971ca3a3c08035f483dbefb45828227907a01`

Verify exact owner-attestation conditions, current owner roles, key possession and AA membership policy. Community admission is independent of host grants; revocation applies to both owner and agent.

## Acceptance

- Altered/reordered condition, wrong owner, revoked/banned owner/agent and stale proof refuse
- Independent source fixtures exercise direct vs virtual membership and timestamp-vs-kind login policy

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/`
- `coax/tests/nostr/`

### #1df7 Authenticated worker claims with atomic resources and fences

status open · size M · labels nostr, coax · milestone #5a3f HOST, REACH and real delegated work

Waits on: #2ff9 Source-preserving Coax proto and domain adapters (open); #d742 HOST invitation and grant admission before effects (open); #62d9 Block OA owner proofs and AA agent membership (open)

Event: `1df760017477910e7f4556907ae3017acec29a6a87eaba50482f1efc27172108`

Implement WORK/COORD/CAP/POL resource/grant admission with worker keys, all-or-none revision CAS, fences, renew/release, expiry and reconciliation. Preserve old project-key display-name comments as historical notices only.

## Acceptance

- Two authenticated workers racing overlapping files get exactly one grant; stale fence cannot commit
- Lease expiry/reconnect/revocation reconciles before reassignment; display-name comments grant nothing

## Files

- `coax/lib/nostr/host/`
- `proto/openagents/coordination/`
- `coax/tests/nostr/`

### #8eb5 Verified event storage, replacement, deletion and expiration

status open · size M · labels nostr, coax · milestone #7d06 Durable clients and signer interfaces

Waits on: #7cdf NIP-01 events: parse, serialize IDs and verify (open); #44fe Host import: IndexedDB bytes (resolved)

Event: `8eb5c7c4c49a811844398ae08949e485fba7cfacf8db2e5da62bcd6bc1483040`

Persist immutable originals plus bounded indexes. Implement NIP-01 replacement/ties, NIP-09 authorized deletion and NIP-40 expiration, schema migration and crash/reload without resurrecting records or leaking private data.

## Acceptance

- Reordered/duplicate/same-time/invalid-deletion/expired transcripts converge with independent expected state
- Restart/migration/quotas preserve originals and tombstones; unverified events cannot enter store

## Files

- `coax/lib/nostr/store.coax`
- `coax/tests/nostr/`

### #845e Multi-relay catch-up and durable offline outbox

status open · size M · labels nostr, coax · milestone #7d06 Durable clients and signer interfaces

Waits on: #8eb5 Verified event storage, replacement, deletion and expiration (open); #7de9 The relay client state machine (open)

Event: `845e5bc9b37cdabad4596ef3fd6f07747f075c31384241214085d758ec1caeb5`

Merge verified state across relays; bounded catch-up, duplicate suppression, publish ACK/refusal/unknown status, reconnect and idempotent offline retry. EOSE/short/tied-timestamp pages never prove completeness.

## Acceptance

- Partition/restart/refusal/late-ACK and timestamp-tie tests preserve unknown vs accepted outcomes
- Missing dependencies/relay disagreement are surfaced; no duplicate effects or false completeness

## Files

- `coax/lib/nostr/relay.coax`
- `coax/lib/nostr/store.coax`
- `coax/tests/nostr/`

### #a7f8 REACH generations, route freshness and direct identity

status open · size M · labels nostr, coax · milestone #5a3f HOST, REACH and real delegated work

Waits on: #d742 HOST invitation and grant admission before effects (open); #8eb5 Verified event storage, replacement, deletion and expiration (open)

Event: `a7f8c77858d9da382e22e064f08fd5c90d434a4c0f90cd8497cbd940e7216c1f`

Validate route/advertisement generation and epoch monotonicity, expiry, rollback protection and authenticated direct-channel binding. Host authorization stays independent of reachable addresses.

## Acceptance

- Reordered old routes, rolled-back epochs, expired advert and wrong peer identity refuse
- Reconnect/direct and relay fallback preserve identity and never broaden the operation grant

## Files

- `coax/lib/nostr/host/`
- `proto/openagents/reach/`
- `nips/openagents/NIP-REACH.md`

### #8bf1 Bounded task delegation, progress, result and PR evidence

status open · size M · labels nostr, coax · milestone #5a3f HOST, REACH and real delegated work

Waits on: #1df7 Authenticated worker claims with atomic resources and fences (open); #a7f8 REACH generations, route freshness and direct identity (open); #845e Multi-relay catch-up and durable offline outbox (open)

Event: `8bf12873f9a0ecace6e0ea297c52f5b10baaf421c172a371829045d9ddfe1537`

Bind WORK/CTX inputs, CAP/POL grants and RUN/SESS journal to one admitted attempt with stable errors/correlation. Preserve original evidence and distinguish running/unknown/failed/completed under reconnect and duplicate delivery.

## Acceptance

- Journal replay/restart converges and cannot execute duplicate requests
- Revocation mid-run stops new authorized effects and retains truthful partial/unknown result/PR state

## Files

- `coax/lib/nostr/host/`
- `apps/openagents-ios/`
- `proto/openagents/`

### #e43a Real Linux Codex task through admitted phone-to-host flow

status open · size L · labels nostr, coax · milestone #5a3f HOST, REACH and real delegated work

Waits on: #8bf1 Bounded task delegation, progress, result and PR evidence (open); #73ce End to end: sign in to openagents.com with the phone (open)

Event: `e43a80e96fc75e3422c68070c82ef0b026adfe3b464695b8fb6ad19b2672cfb7`

Throwaway scoped identity/grant in app -> HOST/REACH over Tailscale -> real Linux Codex task -> streamed progress/result/PR -> fenced completion. Production rollout remains a separate cutover gate.

## Acceptance

- App launch shows actual Linux task progress and resulting PR/evidence
- Revoked/expired/wrong-scope/replayed request performs no new operation; disconnect outcome remains truthful
- Retain reproducible local/staging evidence and explicit owner/device steps

## Files

- `apps/openagents-ios/`
- `coax/lib/nostr/host/`
- `docs/verification/`

### #4f81 FA origin-bound code exchange and credential sessions

status open · size M · labels nostr, coax · milestone #7cbf Block ownership and federated identity

Waits on: #bd06 Selected JWS crypto and exact assertion verification (open); #62d9 Block OA owner proofs and AA agent membership (open)

Event: `4f81c080352e641b3004e36b195b2a3ac1c6344ee42284e221d93fdc54ed8900`

Implement adapter login/code exchange/assertion requests with origin/redirect/secret/session binding and bounded retries. FI/FA credentials and identity metadata remain private.

## Acceptance

- Wrong origin/redirect/code/replayed secret/token class/session expiry refuse
- Credentials never enter public discovery, errors or snapshots

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/fa/`
- `coax/tests/nostr/`

### #4d3e Consumer-backed GS, MP, PL and RS proto projections

status open · size M · labels nostr, coax · milestone #100a Real Coax domain adapters

Waits on: #2ff9 Source-preserving Coax proto and domain adapters (open)

Event: `4d3eb503e0aa63373dd9f87b06b449760f958cd14b14385f5098cf7f161da358`

Add currently absent Block projections and remaining supported official behavior shapes only for named consumers; preserve pins, originals, presence/unknowns and immutable published snapshots. Reserved ER/PMA remain unsupported.

## Acceptance

- Source/hash/profile closure and protoc interoperability pass for new alpha packages
- NIP-GS git signing and project MP/PL/RS consumers have explicit acceptance; reserved text does not advertise runtime

## Files

- `proto/nostr/`
- `proto/tools/`
- `coax/lib/nostr/adapters/`

### #2f8c CL, DV and WP membership and visibility policy

status open · size M · labels nostr, coax · milestone #752e Channels, artifacts and archive consent

Waits on: #62d9 Block OA owner proofs and AA agent membership (open); #2ff9 Source-preserving Coax proto and domain adapters (open)

Event: `2f8cec664c81b0359e27938bf06515cdd8356139b55393ad07a140e615b8e8ca`

Live channel/member/owner read-write admission, viewer-private hidden-channel state and profile commands. Visibility is not membership revocation; unknown metadata never authorizes.

## Acceptance

- Cross-owner/channel/private/system/unlisted/hidden cases fail closed correctly
- Revocation changes next read/write decision and private visibility never reaches public snapshot

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/cl/`
- `coax/tests/nostr/`

### #078f CW composite cursors and bounded completeness

status open · size M · labels nostr, coax · milestone #752e Channels, artifacts and archive consent

Waits on: #2f8c CL, DV and WP membership and visibility policy (open); #8eb5 Verified event storage, replacement, deletion and expiration (open)

Event: `078f8095591fcd1060758845d07f2adcdd3a60090b096c3e21c9ebd1a9e84ce0`

Timestamp+ID cursors, row/depth/window budgets, bound request/signer evidence, ordering and explicit exhaustion. Missing bounds or short relay pages never prove completion.

## Acceptance

- Tied timestamps, reply depth, moving windows and missing pages return deterministic continuation
- Wrong viewer/request/relay evidence refuses; no private row leaks through pagination

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/cw/`
- `coax/tests/nostr/`

### #8211 AR revisions, idempotence and authoritative history

status open · size M · labels nostr, coax · milestone #752e Channels, artifacts and archive consent

Waits on: #2f8c CL, DV and WP membership and visibility policy (open); #8eb5 Verified event storage, replacement, deletion and expiration (open)

Event: `821121005cfd0e865ceefc2c26b965c5e010af9cec8ff6f0a4c06b9787f4594f`

Transactional create/update/move/delete with exact original evidence, prev/root identity, idempotence, read visibility and retention. A decoded revision does not pass CAS.

## Acceptance

- Concurrent prev revisions admit once; duplicate same revision is idempotent
- Wrong root/home/owner/stale prev, deleted and invisible records refuse; replay preserves history

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/ar/`
- `coax/tests/nostr/`

### #e51b IA archive consent and private workspace lifecycle

status open · size M · labels nostr, coax · milestone #752e Channels, artifacts and archive consent

Waits on: #8211 AR revisions, idempotence and authoritative history (open); #078f CW composite cursors and bounded completeness (open)

Event: `e51b75829f623aee3ecf1fd09aef5231638f636da3f8bb5b739514257f983c80`

Implement request/delta/snapshot archive semantics with actor/owner/request binding, consent and relay-scoped UI state. Archiving does not transfer authorship, revoke access or replace channel policy.

## Acceptance

- Wrong actor/owner/request, absent consent and reordered snapshot/delta cases refuse
- Two clients converge without leaking private archive state

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/ia/`
- `coax/tests/nostr/`

### #1b82 AE encrypted memories and tombstones

status open · size M · labels nostr, coax · milestone #3ae7 Private agent data and optional messaging

Waits on: #4878 NIP-44 version 2 encrypt and decrypt (open); #2ff9 Source-preserving Coax proto and domain adapters (open); #62d9 Block OA owner proofs and AA agent membership (open); #8eb5 Verified event storage, replacement, deletion and expiration (open)

Event: `1b8222d7b3a5a157e21f019432ac06adb2749a233e32a4c9ebfeb6756cc84e1c`

Enforce owner-bound encrypted AE memory, blinded addressing, null tombstones and private plaintext lifetime. Signature precedes decryption; original encrypted evidence remains available for replay.

## Acceptance

- Independent source fixtures cover valid/tombstone/missing/wrong owner and replay
- Decrypted body never enters public snapshots or logs; errors wipe owned scratch

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/ae/`
- `coax/tests/nostr/`

### #463e AP persona, settings and configuration resolution

status open · size M · labels nostr, coax · milestone #3ae7 Private agent data and optional messaging

Waits on: #1b82 AE encrypted memories and tombstones (open); #8211 AR revisions, idempotence and authoritative history (open)

Event: `463ea5a00d626e7299ba5f221f7eba353d8779fe7df8fcaecd3a3673a7e90a9f`

Resolve nullable/missing/deleted/unavailable persona/settings/team config with versioned AR-backed snapshots and portable command policy. Unknown or unavailable configuration cannot grant execution.

## Acceptance

- Source fixtures cover null/missing/deleted/unknown config and revision changes
- Untrusted persona/command fields cannot broaden CAP/POL/HOST authority

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/ap/`
- `coax/tests/nostr/`

### #440e AO ephemeral control and observation without durable logs

status open · size M · labels nostr, coax · milestone #3ae7 Private agent data and optional messaging

Waits on: #4878 NIP-44 version 2 encrypt and decrypt (open); #62d9 Block OA owner proofs and AA agent membership (open); #d742 HOST invitation and grant admission before effects (open)

Event: `440e08c1d03f1c849434d91a114e94c2fa3cc48ea1450788f72b3d15751a48c7`

Recipient-bound seq/time/correlation/direction checks and bounded live observation. Ephemeral frames are not persisted, indexed or logged, including debug/error paths. Controls require separate operation authority.

## Acceptance

- Wrong recipient/direction/replay/unknown control refuses; authorized observer reconnect respects consent
- Persistence/log interception proves plaintext observer frames never enter storage or public telemetry

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/ao/`
- `coax/tests/nostr/`

### #6589 AM exact private counters and pricing identity

status open · size M · labels nostr, coax · milestone #3ae7 Private agent data and optional messaging

Waits on: #1b82 AE encrypted memories and tombstones (open)

Event: `658931ee24a6c4894197e1424b888f4f6610127b10e7f50bff273de0eaa189a3`

Preserve exact usage/cost decimals, omitted-vs-zero cache fields, cumulative turn/session sequence and independent pricing identity. Metrics are private facts, not inferred payments or grants.

## Acceptance

- Large counters/decimal/source omissions and duplicate/out-of-order cumulative metrics retain exact values
- No float rounding, inferred price or plaintext public snapshot leakage

## Files

- `coax/lib/nostr/block/`
- `proto/nostr/block/am/`
- `coax/tests/nostr/`

### #fd45 Owner-approved encrypted NIP-49 key import and export

status open · size M · labels nostr, coax · milestone #ea3f Optional encrypted key backup

Waits on: #0e58 Optional NIP-49 KDF, cipher and normalization primitives (open); #8ccd bech32 and NIP-19 entities (resolved); #6b36 Correlated local, NIP-07 and phone signer requests (open)

Event: `fd45092f132a11f4b6d2f39553e6ee07dcf9ea44fe71c36d85c445de71c2cdc6`

Standard ncryptsec framing and device/browser/native adapters; never substitute a homemade key-wrap format. Explicit approval and resource limits, no public key-backup publication or default plaintext IndexedDB.

## Acceptance

- Official cross-implementation encrypt/decrypt plus wrong password/version/capacity/normalization vectors pass
- Owner denial and failure leave no private output or persisted plaintext; optional profile is separately advertised

## Files

- `coax/lib/nostr/keys.coax`
- `apps/openagents-ios/`
- `coax/tests/nostr/`

### #c7e6 Consumer-backed relay discovery and optional client NIPs

status open · size M · labels nostr, coax · milestone #7d06 Durable clients and signer interfaces

Waits on: #845e Multi-relay catch-up and durable offline outbox (open); #f960 Named support profiles, limits and source evidence (resolved)

Event: `c7e6cd613a998f2244c42e7b29defc28ce85da9afb4fe99a50cd8fa07ddc4815`

Add NIP-11 relay capabilities and NIP-65 discovery profiles after core merging; enumerate other official NIPs only with actual consumers. Relay metadata and advertised support are untrusted hints, never authority.

## Acceptance

- Malformed/stale/conflicting relay metadata and unsupported features produce bounded fallback/refusal
- Support matrix identifies implemented optional behavior and independent negative fixtures

## Files

- `coax/lib/nostr/`
- `proto/nostr/`
- `coax/tests/nostr/`

### #862f Optional NIP-17 private conversation profile

status open · size M · labels nostr, coax · milestone #3ae7 Private agent data and optional messaging

Waits on: #ef5a NIP-59 rumor, seal and gift wrap (open); #845e Multi-relay catch-up and durable offline outbox (open); #6b36 Correlated local, NIP-07 and phone signer requests (open)

Event: `862fbef7ad41dc680b78ea87bb7ad06a033b5e7df36a216f2bd8a14e97148113`

Define actual app private messaging over NIP-44/59 with recipient binding, replay/duplicate handling, bounded private history, relay selection and privacy limits; no claim of forward secrecy.

## Acceptance

- Independent two-client send/receive/offline/tamper and recipient-isolation cases pass
- Private bodies never appear in public project data or telemetry; unsupported messaging profiles remain hidden

## Files

- `coax/lib/nostr/`
- `apps/openagents-ios/`
- `coax/tests/nostr/`

### #72ed Advertised Nostr profiles match executable conformance

status open · size L · labels nostr, coax · milestone #a2a7 Consumer conformance and support publication

Waits on: #0653 Reviewed production-secret rollout and recoverable retirement (open); #e43a Real Linux Codex task through admitted phone-to-host flow (open); #4f81 FA origin-bound code exchange and credential sessions (open); #4d3e Consumer-backed GS, MP, PL and RS proto projections (open); #e51b IA archive consent and private workspace lifecycle (open); #463e AP persona, settings and configuration resolution (open); #440e AO ephemeral control and observation without durable logs (open); #6589 AM exact private counters and pricing identity (open); #c7e6 Consumer-backed relay discovery and optional client NIPs (open)

Event: `72ed1e576734883db439e6a0b0fe4868cbcabc206b2d2c556c3be4c15ce4bbb9`

Publish per-profile/target/source/evidence support matrix, version migrations and deliberate unsupported features. Schema/text inventory cannot satisfy runtime evidence. Host/channel production cutover must add domain-specific review, not inherit crypto approval as authorization proof.

## Acceptance

- Native/browser/iOS profile consumers and negative authority/privacy/replay cases pass with pinned artifacts
- A planted advertised-but-unimplemented feature fails release; optional backup/messaging only advertised with own evidence
- New HOST/FI algorithms, authority policies and optional NIP-49 primitives require their own independent source/artifact review before production; initial core-crypto approval is not inherited

## Files

- `coax/nostr.md`
- `docs/verification/`
- `coax/tests/nostr/`

### #0318 A PDF writer in Coax

status open · size L · labels services, coax, print · milestone #2985 A daily digest by email and on paper

Waits on: #f96d Link Coax into the API service (open)

Event: `0318be75e9cf3186852596c32054837e5d9237aff4a811b831f1b255d088e812`

Write one-page PDFs from Coax: Filament as vector strokes, small text in Helvetica (a PDF base font with the same widths the pages' sans uses, so layout matches), lines, boxes and checkboxes, US Letter and A4. Bounded output, no external libraries.

Design: `docs/coaxial-services.md`.

## Acceptance

- A generated PDF passes `qpdf --check` and prints on one page
- Its text is selectable and its strokes stay sharp when zoomed

## Files

- `coax/lib/`

### #85d4 A project digest: yesterday, today, blockers, numbers

status open · size M · labels services, projects · milestone #2985 A daily digest by email and on paper

Waits on: #f96d Link Coax into the API service (open)

Event: `85d4be4c4038c7aed0848792643bfefde174652e5cc2e091c50848f1c2d2f940`

Assemble a day's digest for any project, public or private: what was done and not done yesterday (from statuses, commits and notes), today's milestones and stretch goals, blockers and decisions waiting, a few analytics deltas, and what agents did and plan. One data shape for the page, the email and the PDF.

Design: `docs/coaxial-services.md`.

## Acceptance

- The digest for a fixture project matches a golden file
- Items not done yesterday are carried over or returned to the backlog, never dropped

## Files

- `coax/web/api/`

### #e200 The digest laid out for the page, the email and a printed page

status open · size M · labels services, print, email · milestone #2985 A daily digest by email and on paper

Waits on: #0318 A PDF writer in Coax (open); #85d4 A project digest: yesterday, today, blockers, numbers (open)

Event: `e200699305d153af050c57ff3c92416cf67191a7fff6dcfa798389ec208f4c59`

One Coax layout, three outputs: a section on the project page, an HTML email with a plain-text part, and a one-page PDF in the same fixed order every day, with checkboxes and space for handwriting.

Design: `docs/coaxial-services.md`.

## Acceptance

- Email, PDF and page show the same sections in the same order
- The PDF never runs past one page; overflow says how much more is on the page

## Files

- `coax/web/api/`
- `apps/openagents-web/`

### #8a99 Send the digest every morning to members

status open · size S · labels services, email · milestone #2985 A daily digest by email and on paper

Waits on: #0d37 Send email from the API service through Resend (open); #a145 Morning schedules: Cloud Scheduler calls the API at a local time (open); #e200 The digest laid out for the page, the email and a printed page (open)

Event: `8a99eb3eb29a8aff392a86ab2a55d4f0780a65d98ec3b3509e1d0ee3079da097`

A daily job per project that has a digest set: recipients are members only, each can pause with a link, failures show on the project page.

Design: `docs/coaxial-services.md`.

## Acceptance

- Members get the email with the PDF at the set local time
- A paused member gets nothing; a non-member can never be a recipient

## Files

- `coax/web/api/`

## Done (64)

- #87e0 Bound deep aggregate copy work during compile time · [73c6b07d1b](https://github.com/OpenAgentsInc/openagents/commit/73c6b07d1bf8c926d51a89dd3447dc7ff63e648a)
- #79d5 Analyze actual crypto aggregate paths and guard obligations · [d958227f8e](https://github.com/OpenAgentsInc/openagents/commit/d958227f8eda0049bc8ea69e6eeec0a3b99da347)
- #9b05 Own compile-time strings and release check temporaries · [59df8f79a3](https://github.com/OpenAgentsInc/openagents/commit/59df8f79a361a1dde9c7d7f8448b3594895d2e81)
- #4a8a Make full-graph mutation faster without weakening checks · [17c2656677](https://github.com/OpenAgentsInc/openagents/commit/17c2656677d168bb4a0d037608dc425b7e531aad)
- #7287 Bounded compile-time work inputs for generated crypto tables · [0c7ce1d9c2](https://github.com/OpenAgentsInc/openagents/commit/0c7ce1d9c26aa0105e4a16b460e35cb00ad87ef0)
- #51e6 The phrase gate in Coax, without AES · [0906221785](https://github.com/OpenAgentsInc/openagents/commit/0906221785aad91981be205b83cbb232da78fc90)
- #7e39 Debug-only struct fields and checks · [ed17d7cd26](https://github.com/OpenAgentsInc/openagents/commit/ed17d7cd26b591a4aa8cc2abcb50c2528ae72e37)
- #41bd BIP-340 Schnorr verification · [3ad4257077](https://github.com/OpenAgentsInc/openagents/commit/3ad425707781acf4bcbd49d7d1f7f5a1095155cb)
- #f891 FI issuer, audience, algorithm and authenticated JWKS policy · [a85a51d559](https://github.com/OpenAgentsInc/openagents/commit/a85a51d559431e1f84dbe60871c75a5ba930287e)
- #5931 /chat live for admins · [1f12682eb3](https://github.com/OpenAgentsInc/openagents/commit/1f12682eb325650b1e974cfa5bd6efe7050c8645)
- #e345 Project agents on the member's own Claude key or subscription token · [193e317cfb](https://github.com/OpenAgentsInc/openagents/commit/193e317cfb225a89621ba5b1055a9200d75fb5c9)
- #b675 /chat page in Coax · [830346dd38](https://github.com/OpenAgentsInc/openagents/commit/830346dd383fb8ab7873511e59c146d00398bd20)
- #f944 Bring your own Anthropic API key or Claude subscription token · [aa2ea8af7b](https://github.com/OpenAgentsInc/openagents/commit/aa2ea8af7bbefdfcefd98469d05abb6e28056a85)
- #eac0 The runner's general mode for /chat · [aa2ea8af7b](https://github.com/OpenAgentsInc/openagents/commit/aa2ea8af7bbefdfcefd98469d05abb6e28056a85)
- #cd7e oa-api: chat conversations, turns and events · [a596f3c4b7](https://github.com/OpenAgentsInc/openagents/commit/a596f3c4b7878f916b4e76397268a2f491fd1e01)
- #ff0f wNAF dual multiplication a·G + b·P for verification · [16a0075211](https://github.com/OpenAgentsInc/openagents/commit/16a00752115dddb5fc4b95a5908ce043137cd1e5)
- #bc0b The phone holds the user's Nostr key in the Keychain · [cc189af84f](https://github.com/OpenAgentsInc/openagents/commit/cc189af84f)
- #2cde Review a versioned phrase-gate format and migration · [fa594f441d](https://github.com/OpenAgentsInc/openagents/commit/fa594f441d61e1f759f0b9caa9fee3c25156c767)
- #f878 Project agent live for the first approved project · [e1f9b42437](https://github.com/OpenAgentsInc/openagents/commit/e1f9b424372d0e9e2a48b7d89cd8ae012a655cd8)
- #7fb1 oa-agent runner on Cloud Run · [208c74e488](https://github.com/OpenAgentsInc/openagents/commit/208c74e48894b01f5688b7fc322f102cc70e1d5a)
- #f788 The AGENT panel on a project page · [707e2c5ea5](https://github.com/OpenAgentsInc/openagents/commit/707e2c5ea5dd09a0ae6a529a3d9506ecd8b91b98)
- #fdce The 3188 artifact envelope · [84839caab5](https://github.com/OpenAgentsInc/openagents/commit/84839caab55704c16174556c87ac6c17d5fc8e1a)
- #0af2 Enforce the supported secret-path and variable-time boundary · [e8e91b0bcf](https://github.com/OpenAgentsInc/openagents/commit/e8e91b0bcf0e6a4b0bb2a8903d2f56a6029d6e51)
- #8ee9 Points: affine and Jacobian add, double and mixed add · [374b4ec827](https://github.com/OpenAgentsInc/openagents/commit/374b4ec8274d402dbee164ffdf2a6655e1fc6d55)
- #503d QR code encoder in Coax · [161dce78b0](https://github.com/OpenAgentsInc/openagents/commit/161dce78b0947292c7b38f9d6be0c61a3e8628f0)
- #0bd1 A dudect-style constant-time timing harness · [a2031ecb3c](https://github.com/OpenAgentsInc/openagents/commit/a2031ecb3c36ba8dcfc5c563366d5367fd1517c6)
- #4747 PBKDF2-HMAC-SHA256 · [6f9426ac71](https://github.com/OpenAgentsInc/openagents/commit/6f9426ac71479d829d930a35997a393335020790)
- #89b2 Coax Claude Agent SDK: control protocol, permissions and SDK MCP tools · [5a5724d164](https://github.com/OpenAgentsInc/openagents/commit/5a5724d164)
- #6076 Field inversion and square root with fixed addition chains · [a14e2cccc9](https://github.com/OpenAgentsInc/openagents/commit/a14e2cccc94806bd2bc0dc9b349f5533da01109a)
- #5923 RFC 8785 canonical JSON for contract digests · [6943142bb9](https://github.com/OpenAgentsInc/openagents/commit/6943142bb9bc04de2533b96ffa7fa88611c2235b)
- #9c6f Coax Claude Agent SDK: transport and messages · [9db66dd18d](https://github.com/OpenAgentsInc/openagents/commit/9db66dd18d)
- #cead9 mul_wide: a 64×64→128 multiply as two u64 halves · [4ee3669022](https://github.com/OpenAgentsInc/openagents/commit/4ee3669022)
- #89fb Secure erasure and bounded secret-copy contract · [487c01091f](https://github.com/OpenAgentsInc/openagents/commit/487c01091f311d1e878099e9dec0e3c3df3b7fec)
- #ee72 oa-api: agent sessions, events, queue and approvals · [d86140669d](https://github.com/OpenAgentsInc/openagents/commit/d86140669d)
- #51cb Field multiply and square with compile-time bound proofs · [594f746ec1](https://github.com/OpenAgentsInc/openagents/commit/594f746ec1db689edcf3c5b110abba58d2933e0f)
- #dd90 Scalars mod n in 8×32 limbs · [767e3d7341](https://github.com/OpenAgentsInc/openagents/commit/767e3d734174b02d94efd05587232172a9ac7651)
- #5684 Field elements in 10×26 limbs: load, store, normalize, add, negate · [44e24c812e](https://github.com/OpenAgentsInc/openagents/commit/44e24c812ec6713d5fb18e0165b7d2a68ea909d7)
- #5fc9 ChaCha20 block function and stream cipher · [d6f376be27](https://github.com/OpenAgentsInc/openagents/commit/d6f376be2774cdfd3bd2ea5435133afb6b96e431)
- #723a Close the shipped JSON decoder mutation gaps · [9d6f4f7edc](https://github.com/OpenAgentsInc/openagents/commit/9d6f4f7edc)
- #f20e HMAC-SHA256 and HKDF · [70293b5b70](https://github.com/OpenAgentsInc/openagents/commit/70293b5b70056479657caf43d69f9fd974928eec)
- #44fe Host import: IndexedDB bytes · [d01afcf74d](https://github.com/OpenAgentsInc/openagents/commit/d01afcf74dd5d3702dad5c8d624d095731eb50c2)
- #d0d7 Host import: random bytes · [b2d7a24fcb](https://github.com/OpenAgentsInc/openagents/commit/b2d7a24fcbe5859a2532c11721b8037c7ed524b8)
- #a974 JSON consumer profiles, duplicate keys and safe integer admission · [3da9aaca5b](https://github.com/OpenAgentsInc/openagents/commit/3da9aaca5b)
- #db36 Complete bounded live catch-up across relay caps · [23aa0b9806](https://github.com/OpenAgentsInc/openagents/commit/23aa0b9806b31380dd57eee1b26f6b89957ccbeb)
- #6784 SHA-256, streaming and one-shot, with the BIP-340 tagged hash · [3189fb89db](https://github.com/OpenAgentsInc/openagents/commit/3189fb89db5f7ea0e9b242504668c424a2367219)
- #da6b CSPRNG contract across native, iOS and browser · [7ba394d365](https://github.com/OpenAgentsInc/openagents/commit/7ba394d365f10fbe163a3ed3891023f8ff89d298)
- #0e80 A native vector runner for Coax crypto modules · [1b269c7ae3](https://github.com/OpenAgentsInc/openagents/commit/1b269c7ae381b3a89f60b0a93ba6bc9bca4ffd0e)
- #8ccd bech32 and NIP-19 entities · [c29005554f](https://github.com/OpenAgentsInc/openagents/commit/c29005554fbbe5dbcd3007d7d5553aa324621718)
- #993f Byte helpers: big/little-endian loads, constant-time equality and select · [4fcef5f7c1](https://github.com/OpenAgentsInc/openagents/commit/4fcef5f7c1b65a379d13f6d67e088a32407333ff)
- #2265 A differential harness against libsecp256k1 · [18c48b7979](https://github.com/OpenAgentsInc/openagents/commit/18c48b797937236c0d33a655e4c393ab5678c512)
- #c29a /project/coax reads its project, tasks and order from the relay
- #0ad5 Explicit wrapping add and rotate for u32 and u64 · [2c570ddb97](https://github.com/OpenAgentsInc/openagents/commit/2c570ddb9718a3fcd51a75d1405d0e66c27e267d)
- #f960 Named support profiles, limits and source evidence · [54ea8f5626](https://github.com/OpenAgentsInc/openagents/commit/54ea8f562652f6d726f01c219abcccef2e6b156c)
- #5c3a Bounded hex and base64 codecs · [bc88057ec1](https://github.com/OpenAgentsInc/openagents/commit/bc88057ec1cdbe9bd2d1d72493afa479e825cfd1)
- #ef11 Pin the official test vectors with their sources and hashes · [9c556d7c05](https://github.com/OpenAgentsInc/openagents/commit/9c556d7c05041848cd93567ff8718f7371099bdb)
- #0a4f Restore the E0409 compile-time view diagnostic regression · [cfc36f3ab7](https://github.com/OpenAgentsInc/openagents/commit/cfc36f3ab7e4616e1d5a3f1535e80c37bc93cba2)
- #b17d A value_barrier intrinsic for constant-time code · [b9a5f216f0](https://github.com/OpenAgentsInc/openagents/commit/b9a5f216f0)
- #d223 Bounded JSON pull parser and writer · [8f23a77f35](https://github.com/OpenAgentsInc/openagents/commit/8f23a77f35)
- #47b1 Host import: a WebSocket byte pipe · [df008f96a4](https://github.com/OpenAgentsInc/openagents/commit/df008f96a4)
- #07c2 R3a: reject returns of borrows into local arrays (E0383) · [9d0f246ba1](https://github.com/OpenAgentsInc/openagents/commit/9d0f246ba1b95ae0a491cce8e6cb15f4a1de3d21)
- #9527 Close the pose median gap against the frozen native reference · [ff83c9d959](https://github.com/OpenAgentsInc/openagents/commit/ff83c9d959f2d9d94b676b16a441039c30c7f569)
- #d8c8 Original-source debugging: breakpoints, stepping, values and stacks · [4830ad9c30](https://github.com/OpenAgentsInc/openagents/commit/4830ad9c30ef749d12c75cb57e35ea7ecff2ff2f)
- #b554 Benchmark real engine kernels through the C ABI · [4830ad9c30](https://github.com/OpenAgentsInc/openagents/commit/4830ad9c30ef749d12c75cb57e35ea7ecff2ff2f)
- #a7e7 Compound assignment through a view emits valid C · [e2f8432ea2](https://github.com/OpenAgentsInc/openagents/commit/e2f8432ea2)