You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#409 turned out to have two causes. The first, fixed in the "authenticate consume-notes input notes before every summary" PR (#460), is that miden-client decides per input note whether it is consumed authenticated or unauthenticated based on the local store, and the two commit differently into the signed summary. The fix makes authenticated the canonical mode: creation and every rebuild fetch inclusion proofs from the node and import the proposal's notes before executing (spec 006 FR-015).
That is correct but it is the second-best design. Spec 006 FR-005 and FR-006 originally required the rebuild to be deterministic without touching the store or the node, and that is only achievable if miden-client lets a request keep inline notes unauthenticated. Upstream request: 0xMiden/rust-sdk#2523.
What to do once upstream ships
Make unauthenticated the canonical mode for consume-notes proposals on both SDKs: creation builds the request with the new opt-in, rebuilds do the same, and the pre-rebuild proof import goes away.
Bump the consume-notes metadata version (v3) so proposals created under the authenticated era keep verifying through the v2 path during a transition window, then remove the v2 path per the cut-over pattern already used for v1.
Restore the original wording of spec 006 FR-005, FR-006, and FR-014 for the new version and mark FR-015 as the v2-era rule.
Update the "Authenticated note consumption" section of docs/MULTISIG_SDK.md.
Verification would no longer need the Miden node for proofs or write into the cosigner's store, offline signing of consume-notes proposals from an exported file becomes possible, and the fee is slightly lower because unauthenticated notes skip the in-kernel inclusion check.
Blocked on the upstream issue. Not a release blocker: the authenticated mode is correct and verified live.
Context
#409 turned out to have two causes. The first, fixed in the "authenticate consume-notes input notes before every summary" PR (#460), is that miden-client decides per input note whether it is consumed authenticated or unauthenticated based on the local store, and the two commit differently into the signed summary. The fix makes authenticated the canonical mode: creation and every rebuild fetch inclusion proofs from the node and import the proposal's notes before executing (spec 006 FR-015).
That is correct but it is the second-best design. Spec 006 FR-005 and FR-006 originally required the rebuild to be deterministic without touching the store or the node, and that is only achievable if miden-client lets a request keep inline notes unauthenticated. Upstream request: 0xMiden/rust-sdk#2523.
What to do once upstream ships
docs/MULTISIG_SDK.md.Why it matters
Verification would no longer need the Miden node for proofs or write into the cosigner's store, offline signing of consume-notes proposals from an exported file becomes possible, and the fee is slightly lower because unauthenticated notes skip the in-kernel inclusion check.
Blocked on the upstream issue. Not a release blocker: the authenticated mode is correct and verified live.