corona/CHANGELOG.md

# corona CHANGELOG

Notable changes to the `corona` module. Pre-release; semantic versioning
applied per PHILOSOPHY.md (patch only -- never minor/major without explicit
approval).

## v0.7.5 (public-BFT Bootstrap default — symmetry with Reanchor)

Closes the last asymmetry left over from v0.7.3: the unqualified
`keyera.Bootstrap` and `keyera.BootstrapWithSuite` entrypoints still
routed through the legacy single-dealer Shamir share-out, so any caller
who picked the "obvious" name silently inherited the trusted-dealer
caveat at chain genesis. v0.7.5 flips both defaults to
`BootstrapPedersen`: no single party ever holds the master secret `s`
at any point in the ceremony. The mirror move was already made in
v0.7.4 for `Reanchor`; v0.7.5 completes the symmetry so the API surface
has **one** safe default for opening a key era and **one** explicit
opt-in (`BootstrapTrustedDealer` / `ReanchorTrustedDealer`) for
HSM / TEE ceremonies.

### Signature changes (`keyera/keyera.go`)

- `keyera.Bootstrap(t, validators, groupID, eraID, entropy)` now
  returns `(*KeyEra, *BootstrapTranscript, error)` (was `(*KeyEra,
  error)`) and routes through `BootstrapPedersen`. Callers MUST commit
  the transcript to the chain for the era to ratify.
- `keyera.BootstrapWithSuite` mirrors the same signature change and
  routes through `BootstrapPedersen` with the supplied suite.

### Public-BFT-safe path (no functional change vs v0.7.4)

- `BootstrapPedersen` and `ReanchorPedersen` remain the canonical
  implementations; the v0.7.5 change is a default-routing flip, not a
  new construction.

### Legacy trusted-dealer aliases (explicit opt-in only)

- `keyera.BootstrapTrustedDealer` /
  `keyera.BootstrapTrustedDealerWithSuite` continue to expose the
  legacy single-dealer Shamir share-out (byte-equivalent to the
  pre-v0.7.5 unqualified Bootstrap). The shared implementation is now
  the unexported `bootstrapTrustedDealerImpl` so the public-facing
  aliases cannot drift from each other; `ReanchorTrustedDealerWithSuite`
  also routes through this helper.

### Structural invariant

- `BootstrapPedersen` requires `n >= 2 && t < n`. The unqualified
  Bootstrap therefore inherits the same constraint, by construction;
  callers that need `t == n` (every validator MUST sign) must select
  the trusted-dealer entrypoint explicitly. This is the "loud name"
  the cryptographer's audit prompt asks for: any deployment that
  cannot tolerate the dealer's trust boundary will be caught at the
  call site, not silently.

### Tests

All green via `GOWORK=off go test -count=1 -short ./...`:

- `keyera_test.go` -- updated to drop `t == n` from the public-BFT
  cases (now uses `t = n - 1`); `Bootstrap` 3-tuple return propagated.
- `hashsuite_immut_test.go` -- same threshold adjustment.
- `bootstrap_pedersen_test.go` -- `TestBootstrapTrustedDealer_Legacy
  Alias` renamed to `TestBootstrapTrustedDealer_StandalonePath` since
  the two paths are no longer byte-equivalent; the test pins that the
  Pedersen `Bootstrap` correctly rejects `t == n`.

### Documentation

- `DEPLOYMENT-RUNBOOK.md` §Bootstrap-Trust decision matrix updated:
  the unqualified `Bootstrap` now appears in the "public-BFT" row;
  the trusted-dealer alias is the explicit HSM/TEE-ceremony row.
- `AUDIT-2026-05.md` §0 v0.7.5 closure note; §8.5 new caveat: chains
  that historically used `t == n` MUST adopt `t < n` to take the
  public-BFT path. Otherwise they remain on `BootstrapTrustedDealer`
  with the dealer caveat explicit at the call site.

### Cross-runtime byte equality

- The unqualified `Bootstrap` bytes diverge from prior runs because
  the underlying ceremony changed. No deployed KAT pins `Bootstrap`
  output; the canonical KATs target `BootstrapPedersen` (under its
  own name) and `BootstrapTrustedDealer` (under its own name). Future
  cross-runtime ports MUST distinguish the two paths by name.

## v0.7.4 (public-BFT Reanchor via dkg2 Pedersen-DKG; mathSqrt cleanup)

Closes the Reanchor trusted-dealer regression flagged in v0.7.3 red
review: `keyera.Reanchor` previously called `BootstrapWithSuite` (the
trusted-dealer path) under the hood, so a governance-driven Reanchor
re-introduced the dealer caveat at every rotation. v0.7.4 routes
`Reanchor` through `ReanchorPedersen` by default (Pedersen-DKG over
`R_q` + Path (a) noise flooding) so no party ever holds the new
era's master secret `s` at any point in the rotation. The legacy
trusted-dealer behaviour is retained behind explicit
`ReanchorTrustedDealer` aliases for HSM / TEE ceremonies.

### New public surface (`keyera/reanchor_pedersen.go`)

- `keyera.ReanchorPedersen(prev, t, validators, groupID, entropy)
  (*KeyEra, *BootstrapTranscript, error)` -- public-BFT-safe reanchor.
  Routes through `BootstrapPedersen` with the new era's EraID =
  prev.EraID+1 and GenesisEpoch = prev.State.Epoch+1.
- `keyera.ReanchorPedersenWithSuite(prev, suite, t, validators,
  groupID, entropy) (*KeyEra, *BootstrapTranscript, error)` --
  suite-explicit variant. Reanchor is the only lifecycle entrypoint
  that may pin a hash profile different from the prior era's.

### Signature changes (`keyera/keyera.go`)

- `keyera.Reanchor` and `keyera.ReanchorWithSuite` now return
  `(*KeyEra, *BootstrapTranscript, error)` (was `(*KeyEra, error)`)
  and route through `ReanchorPedersen`. The transcript MUST be
  committed to the chain for the new era to ratify.
- `keyera.ReanchorTrustedDealer` /
  `keyera.ReanchorTrustedDealerWithSuite` -- new explicit aliases
  for the legacy single-dealer path. Byte-equivalent to the
  pre-v0.7.4 trusted-dealer Reanchor behaviour. Use ONLY for
  ceremony scenarios where a non-distributed trust root is
  acceptable by policy (see `DEPLOYMENT-RUNBOOK.md §Bootstrap-Trust`).

### Cleanup (`keyera/bootstrap_pedersen.go`)

- `mathSqrt` -- a 12-iteration Newton's-method in-tree
  implementation -- replaced with stdlib `math.Sqrt`. The "keeps
  the import surface tight" rationale was false parsimony; the
  Path (a) noise σ is computed once at bootstrap and stdlib gives
  the canonical IEEE 754 result without ULP drift.

### Tests (`keyera/reanchor_pedersen_test.go`)

All green via `GOWORK=off go test -count=1 -short ./keyera/`:

- `TestReanchorPedersen_RoundTrip` -- bootstrap → reanchor → sign
  with new shares → verify under new GroupKey. Asserts EraID
  increments, GenesisEpoch + State.Epoch advance, HashSuiteID is
  inherited, transcript is non-nil.
- `TestReanchorPedersen_NoMasterSecret` -- structural assertions
  that no `dkg2.DKGSession` field exposes the master secret and
  no two new-committee shares collide.
- `TestReanchorPedersen_DishonestParty` -- tampered share triggers
  `ErrBootstrapPedersenAbort` with a named `ComplaintBadDelivery`.
- `TestReanchorTrustedDealer_LegacyAlias` -- legacy alias still
  works; byte-equivalent across `ReanchorTrustedDealer` and
  `ReanchorTrustedDealerWithSuite(Corona-SHA3)`.

Existing tests updated to the new signature:

- `TestReanchorOpensNewEra` (`keyera/keyera_test.go`) -- now uses
  `t=2, n=3` because the public-BFT-safe path requires `t < n`.
- `TestReanchorMayChangeSuite` (`keyera/hashsuite_immut_test.go`)
  -- same threshold adjustment; same suite-migration assertion.

### Documentation

- `AUDIT-2026-05.md` -- §0 v0.7.4 closure note; §8.3 caveat updated
  (Reanchor closure); §9 references with verified IACR ePrint IDs
  for the 2025 citations (2024/959, 2024/1113, 2025/871, 2025/872,
  2025/1691) and explicit `[citation TBD]` for unverifiable lines
  rather than fabricated IDs.
- `DEPLOYMENT-RUNBOOK.md` -- §Bootstrap-Trust decision matrix
  expanded to cover Reanchor; default routing pinned to
  Pedersen-DKG for both Bootstrap and Reanchor.

### Cross-runtime byte equality

- KAT manifest preserved (`scripts/regen-kats.manifest.sha256`);
  no cross-runtime KATs reference BootstrapPedersen transcripts.
- `math.Sqrt` vs the previous Newton-12-iter implementation diverges
  by 1 ULP for some n (e.g. n=2, n=10). No deployed KAT pins
  `pathANoiseParameters` output, so this is harmless within the
  in-tree replay tests; future cross-runtime ports MUST use
  `math.Sqrt` (or equivalent IEEE 754 stdlib sqrt) to byte-match.

## v0.7.3 (public-BFT Bootstrap via dkg2 Pedersen-DKG + Path (a) noise flooding)

Closes the last trusted-dealer caveat in `keyera.Bootstrap` for any
deployment that cannot vouch for a single dealer's host platform. The
trusted-dealer path is retained (under a renamed alias) for genesis
ceremonies where a non-distributed trust root is acceptable by policy.

### New public surface (`keyera/bootstrap_pedersen.go`)

- `keyera.BootstrapPedersen(suite, t, validators, groupID, eraID, entropy)
  (*KeyEra, *BootstrapTranscript, error)` -- public-BFT-safe bootstrap.
  Routes the keygen ceremony through `dkg2/` (Pedersen-DKG over `R_q`) +
  Path (a) noise flooding so no single party ever holds the master
  secret `s` at any point in the ceremony.

- `keyera.FinishBootstrapPedersen(suite, t, validators, ..., dkgParams,
  sessions, round1) (*KeyEra, *BootstrapTranscript, error)` -- kernel
  entrypoint that drives Rounds 1.5 + 2 + Path (a) on a pre-computed
  set of Round 1 outputs. Tests use this to inject deliberately
  dishonest contributions and exercise the identifiable-abort path.

- `keyera.BootstrapTrustedDealer` / `keyera.BootstrapTrustedDealerWithSuite`
  -- renamed aliases for the legacy single-dealer path. Retained for
  genesis ceremonies where the foundation explicitly chooses a
  non-distributed trust root (see `DEPLOYMENT-RUNBOOK.md
  §Bootstrap-Trust` decision matrix).

- `keyera.BootstrapTranscript` -- public, byte-stable record produced
  by every Pedersen bootstrap run. Honest validators that observe the
  same cohort messages compute identical transcript bytes; the chain
  commits to `TranscriptHash` to ratify the era.

- `keyera.AbortEvidence` + `keyera.ExtractAbortEvidence(err)` -- public
  surface for identifiable-abort consumption. A non-nil `AbortEvidence`
  carries the disqualified set and signed `dkg2.Complaint`s ready for
  the slashing pipeline.

### Tests (`keyera/bootstrap_pedersen_test.go`)

All green via `GOWORK=off go test -count=1 -short ./keyera/`:

- `TestBootstrapPedersen_RoundTrip` -- 5-party Pedersen-DKG with `t=3`;
  transcript determinism across replays; bTilde / digest stability.
- `TestBootstrapPedersen_DishonestDealer` -- tampered share-to-recipient-0
  triggers `ErrBootstrapPedersenAbort` naming sender 2; `AbortEvidence`
  carries a re-checkable `ComplaintBadDelivery`.
- `TestBootstrapPedersen_FollowedBySign` -- Pedersen bootstrap → standard
  2-round threshold sign → `threshold.Verify` PASS. The noise-flooded
  GroupKey is structurally identical to a trusted-dealer Corona setup.
- `TestBootstrapPedersen_NoMasterSecretInMemory` -- structural assertion
  that `dkg2.DKGSession` exposes no master-secret field, and that no two
  parties' SkShares / Lambdas collide.
- `TestBootstrapPedersen_ParameterValidation` -- bounds checking.
- `TestBootstrapPedersen_DefaultSuite` -- `nil` resolves to Corona-SHA3.
- `TestBootstrapTrustedDealer_LegacyAlias` -- legacy alias is byte-
  equivalent to historical `Bootstrap`.

### Documentation

- `AUDIT-2026-05.md` -- read-only SOTA refresh covering threshold lattice
  DKG / signing literature 2024-2026. Verdict: Boschini-Takahashi-Tibouchi
  2024/1113 remains canonical; 2025 follow-ups (del Pino, Doerner-Kondi,
  Hofheinz, Beimel-Eitan) are complementary or non-blocking; no SOTA
  refresh blocks this revision.
- `DEPLOYMENT-RUNBOOK.md` -- new `§Bootstrap-Trust` decision matrix
  documenting Option A (`BootstrapPedersen`, recommended) vs Option B
  (`BootstrapTrustedDealer`, ceremony-only) trade-off.
- `keyera/keyera.go` -- inline trust-model documentation pointing at
  `BootstrapPedersen` as the public-BFT-safe alternative.

### Cross-runtime byte equality

- KAT manifest preserved (`scripts/regen-kats.manifest.sha256`); existing
  trusted-dealer KATs continue to byte-match `~/work/luxcpp/crypto/corona/`.
- `BootstrapPedersen` adds new ceremony bytes (deterministic given
  entropy); a future cross-runtime port can pin them via the public
  `BootstrapTranscript.TranscriptHash`.

## v0.7.0 (Tier A full closure -- EC + Lean + Jasmin + dudect scaffolding)

This revision lands the Tier A formal-methods scaffolding for Corona,
mirroring Pulsar's structure exactly. Closes GATE-1 / GATE-2 / GATE-3a
from the v0.6.0 sign-off.

### EasyCrypt theories (13 files; admit budget 0/0)

- `proofs/easycrypt/Corona_N1.ec` -- master byte-equality theorem
  (`corona_n1_byte_equality`).
- `proofs/easycrypt/Corona_N4.ec` -- reshare public-key preservation
  (`corona_n4_pk_preservation_honest`).
- `proofs/easycrypt/Corona_N1_Memory.ec` -- byte-memory model + frame laws.
- `proofs/easycrypt/Corona_N1_Signature_Codec.ec` -- signature codec.
- `proofs/easycrypt/Corona_N1_Combine_Layout.ec` -- Combine byte layout.
- `proofs/easycrypt/Corona_N1_Sign_Layout.ec` -- Sign byte layout.
- `proofs/easycrypt/Corona_N1_Combine_Refinement.ec` -- 3 byte-walk +
  memory-separation + layout-frame axioms.
- `proofs/easycrypt/Corona_N1_Sign_Refinement.ec` -- 3 byte-walk axioms.
- `proofs/easycrypt/Corona_N1_Combine_Wrapper.ec` -- wrapper bridge.
- `proofs/easycrypt/Corona_N1_Sign_Wrapper.ec` -- wrapper bridge.
- `proofs/easycrypt/Corona_N1_Extracted.ec` -- IMPLEMENTATION-BACKED
  end-to-end theorem.
- `proofs/easycrypt/lemmas/RLWE_Functional.ec` -- in-house EC
  mechanization of Boschini ePrint 2024/1113 §3 Sign + Verify.
- `proofs/easycrypt/lemmas/Corona_CT.ec` -- constant-time obligations.
- `proofs/easycrypt/README.md` -- file map + admit budget.

### Lean <-> EC bridge (5 axioms)

- `proofs/lean-easycrypt-bridge.md` -- 5-axiom Lean <-> EC bridge:
  `lagrange_inverse_eval`, `threshold_partial_response_identity`,
  `add_share_zeroR`, `reconstruct_linear`, `shamir_correct`.
- `~/work/lux/proofs/lean/Crypto/Corona/Shamir.lean` -- Lagrange-over-
  polynomial-ring algebraic core.
- `~/work/lux/proofs/lean/Crypto/Corona/OutputInterchange.lean` --
  Class N1 verifier-compatibility.
- `~/work/lux/proofs/lean/Crypto/Corona/Unforgeability.lean` --
  EUF-CMA reduction to Module-LWE.
- `~/work/lux/proofs/lean/Crypto/Corona/dkg2.lean` -- Pedersen-VSS DKG.

### Jasmin sources

- `jasmin/lib/corona_params.jinc` -- parameter set.
- `jasmin/lib/seed.jinc` -- per-round PRNG seed derivation.
- `jasmin/lib/transcript.jinc` -- transcript-hash binder.
- `jasmin/lib/mac.jinc` -- per-peer MAC primitive.
- `jasmin/lib/lagrange.jinc` -- Lagrange-coefficient computation.
- `jasmin/threshold/round1.jazz` -- per-party Round-1 commit (#ct).
- `jasmin/threshold/round2.jazz` -- per-party Round-2 response (#ct).
- `jasmin/threshold/combine.jazz` -- Combine aggregation (#ct).
- `jasmin/rlwe/sign.jazz` -- centralized Boschini Sign reference.
- `jasmin/README.md` -- layout + refinement-target table.

### dudect harness

- `ct/dudect/verify_ct.go` + `dudect_verify.c` -- Verify harness.
- `ct/dudect/combine_ct.go` + `dudect_combine.c` -- Combine harness.
- `ct/dudect/dudect_compat.h` -- AArch64 cycle-counter compat shim.
- `ct/dudect/Makefile` + `fetch.sh` + `run-submission.sh`.

### CI orchestrator (7 gates)

- `scripts/check-high-assurance.sh` -- mirrors Pulsar's structure
  exactly. Sequences jasmin + ec-admits + ec-regressions +
  ec-refinement-scaffold + lean-bridge + extraction + ec-compile.
- `scripts/checks/ec-admits.sh` -- admit-budget 0/0 static guard.
- `scripts/checks/ec-regressions.sh` -- retired-axiom regression guard.
- `scripts/checks/ec-refinement-scaffold.sh` -- declare-axiom hygiene.
- `scripts/checks/ec-compile.sh` -- EC compile gate.
- `scripts/checks/jasmin.sh` -- jasmin type-check + jasmin-ct gate.
- `scripts/checks/extraction.sh` -- Jasmin -> EC extraction sanity.
- `scripts/check-lean-bridge.sh` -- 5-axiom Lean <-> EC bridge guard.

### Tests

- `threshold/e2e_threshold_variants_test.go` -- (3,2), (5,3), (7,4),
  (10,7) committee-size e2e variants + KAT replay determinism.
- `threshold/fuzz_verify_test.go` -- `FuzzVerifyParseSignature` +
  `FuzzVerifyRandomBytes`.

### Documentation updates

- `AXIOM-INVENTORY.md` -- v0.7.0 EC residual axiom inventory (admit
  budget 0/0; 5 Lean-bridged + N codec + construction-level axioms).
- `PROOF-CLAIMS.md` -- §3.1 and §3.7 updated to reflect the EC + Lean
  + Jasmin scaffold landing.
- `CRYPTOGRAPHER-SIGN-OFF.md` -- v0.2; closes GATE-1, GATE-2, GATE-3a;
  opens GATE-3b, GATE-4, GATE-5 as v0.8.0 audit-grade targets.

## v0.5.0 (NIST MPTC submission package scaffolding)

### Submission documentation added (no code changes)

This revision adds the NIST MPTC Class N1 + N4 submission package
scaffolding. Pattern mirrors `luxfi/pulsar` (the M-LWE byte-equal
FIPS 204 sibling), adapted honestly to Corona's lighter proof tier.

- `SUBMISSION.md` — NIST MPTC cover sheet. Cites Boschini et al. ePrint
  2024/1113 (IEEE S&P 2025) as the underlying construction. Declares
  construction-level N1 (no FIPS standard target available for Module-LWE
  threshold) + N4 (`(A, bTilde)` preserved across reshare within key era).
  Two-variant honesty disclosure: Pedersen DKG (`dkg2/`) is the production
  path; legacy `dkg/` is retained for historical reference only.
- `NIST-SUBMISSION.md` — one-page executive summary.
- `SPEC.md` — standalone construction specification. Pointer to
  `papers/lp-073-pulsar/` LaTeX sections + `DESIGN.md` invariants.
  Full single-document `spec/corona.tex` is roadmap (v0.6.0).
- `PATENTS.md` — royalty-free patent grant + defensive termination.
  Claim scope explicitly EXCLUDES the Boschini et al. published
  construction (academic prior art); claims are limited to Corona's
  production lifecycle additions.
- `PROOF-CLAIMS.md` — HONEST framing. Corona ships NO mechanized
  refinement (no EasyCrypt, no Lean, no Jasmin). Construction-level
  claim only; correctness reduces to code review + KAT + Boschini et
  al. analysis. Mechanized refinement is roadmap (v0.7.0).
- `TRUSTED-COMPUTING-BASE.md` — implementation TCB. Structurally
  simpler than Pulsar's (no EC/Lean/Jasmin tools); higher per-component
  trust on Go reference review + KAT cross-runtime byte-equality.
- `DEPLOYMENT-RUNBOOK.md` — operator-facing trust-model disclosure.
- `LICENSING.md` — pointer to LICENSE + Lux three-tier IP strategy.
- `CONTRIBUTING.md`, `SECURITY.md` — standard NIST-MPTC artifacts.
- `docs/evaluation.md` — performance + correctness + KAT + CT evidence.
- `docs/ietf-draft-skeleton.md` — IETF draft skeleton (HONEST: draft).
- `docs/nist-mptc-category.md` — Class N1 + N4 mapping for Corona.
- `docs/patent-claims.md` — attorney-prep claim drafts (FEWER than
  Pulsar — only Corona-novel lifecycle additions, not the published
  Boschini et al. construction).
- `docs/design-decisions.md`, `docs/family-architecture.md`,
  `docs/threat-model.md` — adapted from Pulsar's pattern to Corona's
  Module-LWE / `R_q` setting.

### Honest gaps documented

This submission EXPLICITLY does NOT include (per `PROOF-CLAIMS.md` §3):
- EasyCrypt theories (`Corona_N1.ec` does not exist).
- Lean ↔ EC algebraic-bridge files.
- Jasmin sources (libjade does not target Corona's parameter set).
- Mechanized refinement proof of any kind.
- dudect-style statistical CT validation harness.
- Full LaTeX `spec/corona.tex` single-document spec (paper sections at
  `papers/lp-073-pulsar/` are the current canonical material).
- Parameter-set worksheet with concrete lattice-estimator bounds.
- ACVP/CAVP algorithm validation certificate (no NIST ACVP test vector
  set exists for Module-LWE threshold).
- FIPS 140-3 module validation (downstream).
- External cryptographic audit (engaged lab) — roadmap v0.8.0.

### CI gates maintained

- `scripts/build.sh` exits 0 on a fresh clone.
- `scripts/test.sh` exits 0 (Go unit + integration + KAT).
- `scripts/regen-kats.sh --verify` exits 0 (cross-runtime byte-equality
  with `~/work/luxcpp/crypto/corona/` C++ port).
- `scripts/check-high-assurance.sh` — stub at this revision; runs the
  available checks (no EC/Lean/Jasmin to run).

### Tarball cut tooling

- `scripts/cut-submission.sh` — adapted from Pulsar's; produces
  `submission-YYYY-MM-DD.tar.gz` from a clean tag on `main`.

## v0.4.1 (current)

Latest production tag at this revision. See git log for the full v0.4.x
history (Corona purge, domain-separation rename PULSAR-* → CORONA-*,
Go 1.26.3 toolchain bump, parallel `VerifyBatch` for N-signature
consensus throughput).

## Unreleased

### Breaking — F22 hash-suite injection into Sign

`corona/primitives/hash.go` no longer hardcodes `blake3.New()`. Every
Sign-path primitive now takes a `hash.HashSuite` as its first argument:

```
PRNGKey(suite, skShare)                       // was PRNGKey(skShare)
PRNGKeyForRound(suite, skShare, sid)          // was PRNGKeyForRound(skShare, sid)
GenerateMAC(suite, TildeD, MACKey, ...)       // was GenerateMAC(TildeD, MACKey, ...)
GaussianHash(suite, r, hash, mu, sigma, ...)  // was GaussianHash(r, hash, mu, sigma, ...)
PRF(suite, r, sd_ij, key, mu, hash, n)        // was PRF(r, sd_ij, key, mu, hash, n)
Hash(suite, A, b, D, sid, T)                  // was Hash(A, b, D, sid, T)
LowNormHash(suite, r, A, b, h, mu, kappa)     // was LowNormHash(r, A, b, h, mu, kappa)
```

`suite == nil` resolves to the production default, `Corona-SHA3`
(cSHAKE256 / KMAC256 / TupleHash256 per FIPS 202 + NIST SP 800-185).
The legacy `Corona-BLAKE3` suite remains available via
`hash.NewCoronaBLAKE3()` for cross-port byte checks.

`sign.Party` gains a `Suite hash.HashSuite` field, defaulted by
`NewParty` to `hash.Default()`. Operators can construct with an explicit
suite via `NewPartyWithSuite(id, r, rXi, rNu, sampler, suite)`. The free
function `sign.Verify(...)` keeps its previous signature and now resolves
to the production default internally; the suite-explicit form is
`sign.VerifyWithSuite(suite, ...)`.

This closes the gap where the HIP-0077 claim that Corona uses SHA-3
cSHAKE256/KMAC256/TupleHash256 in production was structurally false at
the Sign layer (only `corona/reshare/`, `corona/dkg2/`, `corona/keyera/`
were consuming `corona/hash/HashSuite` previously).

### Follow-up — KAT regeneration

The historical BLAKE3 KAT transcripts emitted by
`cmd/corona_oracle_v2` were computed against the previous raw
`blake3.New()` framing in `primitives/hash.go`. After this refactor, the
oracle still emits under `coronahash.NewCoronaBLAKE3()`, but the framing
now includes the suite's customization tags (`CORONA-HC-v1`,
`CORONA-HU-v1`, `CORONA-PRF-v1`, etc.) and length-prefixing, so the
emitted bytes no longer byte-match pre-refactor JSON.

The Corona-SHA3 production KATs are not yet emitted. Both lie outside
the scope of this PR:

- Regenerate the legacy BLAKE3 oracle JSON
  (`go run ./cmd/corona_oracle_v2 emit --out ./test/kats/blake3`)
  and cross-validate with the C++ port.
- Land a parallel `cmd/corona_oracle_v3` (or `--suite` flag) that
  emits Corona-SHA3 KATs under `./test/kats/sha3/` and pin them as the
  normative reference for downstream ports.

The skipped test `TestKATsRegenerated` in
`primitives/hash_test.go` is the placeholder guard.