docs: certify Corona a STRICT trustless lane (no-reconstruct signing, gate 5)

- LLM.md: Latest Tag -> v0.10.0; record the no-reconstruct signing gate +
  v0.9.0 DKG cutover in the recent-commits table.
- PROOF-CLAIMS.md: catalogue the new code-level conformance gate alongside
  the Lean-4 secret_aggregate_no_reconstruct proof, framed honestly as a
  TEST gate (not a proof-assistant artifact).

Audit verdict (branch audit/no-reconstruct-signing): Corona threshold signing
is no-reconstruct — each party emits z_i = R_i*u + maskPrime_i + c*lambda_i*s_i
- mask_i from its OWN share; SignFinalize sums the masked partials z_sum = Sum
z_j = R*u + c*s; the secret s = Sum lambda_j*s_j appears only as the coefficient
of the public challenge c inside the masked aggregate and is never materialised.
Dealerless keygen (keyera.Bootstrap) + no-reconstruct signing => strict
trustless lane for STRICT_DUAL_PQ / POLARIS_MAX.

LLM.md

@@ -1,7 +1,7 @@
 # Corona -- Agent Knowledge Base
 
 **Repository**: github.com/luxfi/corona
-**Latest Tag**: v0.8.0 (dealerless Pedersen DKG is the production keygen default; signing never reconstructs the master secret)
+**Latest Tag**: v0.10.0 (Corona certified a STRICT trustless lane: dealerless Pedersen DKG keygen + no-reconstruct signing — the no-reconstruct signing property is now PINNED by a code-level structural+behavioural gate, `threshold/no_reconstruct_sign_test.go`)
 **Status**: Production (consensus path); NIST MPTC submission package included. Sibling submission `luxfi/pulsar` is the M-LWE byte-equal FIPS 204 path.
 
 ## Purpose (one-liner)
@@ -52,6 +52,8 @@ Pulsar does; Corona's Module-LWE construction has no FIPS standard target to ref
 
 | SHA | Tag | Impact |
 |-----|-----|--------|
+| `500d319` | v0.10.0 | threshold: pin Corona NO-RECONSTRUCT signing (gate 5, trustless-by-default law). `threshold/no_reconstruct_sign_test.go` — GATE A go/ast scan (no signing function recombines shares into s nor invokes the trusted-dealer keygen; per-party `party.Lambda` allowed; negative-control verified), GATE B reflect (Round1Data/Round2Data/Signature carry no share), GATE C independent-verifier ceremony. Complements the Lean-4 `secret_aggregate_no_reconstruct` proof at the code level. Audit verdict: Corona is a STRICT trustless lane for STRICT_DUAL_PQ / POLARIS_MAX |
+| `7996ad7` | v0.9.0 | merge Phase-3a: corona keyera DKG cutover onto `luxfi/dkg` v0.2.0 (shared dealerless no-reconstruct VSS); `dkg2` package deleted |
 | `f08e2b5` | v0.8.0 | threshold: trusted-dealer keygen made explicit/footgun-only; dead `ReconstructSecret` dropped; sub-quorum soundness pinned — signing sums partials, master secret never formed |
 | `7c102d2` | v0.7.9 | threshold: reject duplicate PartyID in Round2/Finalize combine (kernel-boundary uniq guard) |
 | `6b4d5d5` | v0.7.8 | docs: correct stale 'no EC toolchain' claims; combine bridge discharged to lemma + jasminc available |

PROOF-CLAIMS.md

@@ -51,6 +51,23 @@ single-party Boschini signature — a STANDARD PQ assumption, **not** an
 implementation reconstruct. Model 2's EC side is **written, machine-recheck
 pending EasyCrypt**; its Lean core is machine-checked now.
 
+*Code-level conformance gate (added v0.10.0).* The same no-reconstruct
+property is pinned at the IMPLEMENTATION level by
+`threshold/no_reconstruct_sign_test.go`: (GATE A) a `go/ast` scan of every
+signing/verify function proving none calls an across-party reconstruction
+primitive (`reconstruct`/`interpolate`/`combineShares`/`recover*`/
+`ShamirSecretSharing`/`lagrangeAtZero`) nor the trusted-dealer keygen
+(`Gen`/`GenerateKeysTrustedDealer`) — per-party `party.Lambda` on the party's
+OWN share is the legitimate no-reconstruct mechanism and is deliberately NOT
+forbidden; the gate's teeth are negative-control-verified (injecting a
+reconstruct call into `SignFinalize` trips it); (GATE B) a `reflect` gate
+proving the inter-party messages `Round1Data`/`Round2Data` and the final
+`Signature` carry no share/sk/seed/λ, so the aggregator never holds a second
+party's secret; (GATE C) a real (3,5) no-reconstruct ceremony verifying under
+the independent Corona verifier. This is a **test gate** (assurance tag:
+code-review/interop-tested at the construction level), NOT a proof-assistant
+artifact — it complements, and does not replace, the Lean core.
+
 **Disclosure 2 — the no-leak property is NOT independently interop-tested.**
 Corona's KAT cross-validation is **Go↔C++ of the SAME construction**
 (`luxcpp/crypto/corona`), not against an independent verifier. There is no