docs: README + SUBMISSION-STATUS + BLOCKERS + CHANGELOG updates for v0.3.0

Promote Magnetar from Tier B (production library + submission
scaffold) to Tier A documentation shape complete.

- README.md: flipped status to "Tier A documentation shape complete".
  Updated "What v0.3.0 ships" / "does NOT yet ship" to reflect
  closed BLK-5/BLK-8 + open gates per CRYPTOGRAPHER-SIGN-OFF.md.

- SUBMISSION-STATUS.md: Phase 4 (submission package) CLOSED for
  doc shape; Phase 5 (cryptographer review) PARTIAL (internal
  v0.3.0, external roadmap v0.6.0). Updated headline to "Tier A
  documentation shape complete; full Tier A formal-methods +
  measurement + lifecycle gates open."

- BLOCKERS.md: closed BLK-8 (submission package documentation
  shape) at v0.3.0 with full 12-document inventory; partially
  closed BLK-9 (internal review landed; external roadmap v0.6.0).
  BLK-4 (v0.4 lifecycle additions), BLK-6 (cross-validation
  harness), BLK-7 (proof artifacts) remain open and tracked to
  CRYPTOGRAPHER-SIGN-OFF.md Gates.

- CHANGELOG.md: new file. v0.3.0 entry documents the Tier A
  documentation shape: 9 new submission docs + 2 new scripts.
  v0.2.0 entry (back-filled) documents the Tier B production
  library landing. Honesty notes preserved.

- .gitignore: added proofs/ exclusion. EC theory shells are
  work-in-progress targeted for v0.5.0 commit; at v0.3.0
  PROOF-CLAIMS.md §3.1 explicitly states "no EC theories ship at
  v0.3.0" — keeping them out of the working-tree-clean gate.

.gitignore

@@ -7,3 +7,10 @@ vectors-tmp/
 .DS_Store
 *.swp
 *~
+
+# EC theory shells (work-in-progress; targeted for v0.5.0 commit).
+# At v0.3.0 PROOF-CLAIMS.md §3.1 explicitly states "no EC theories
+# ship at v0.3.0" — keeping these out of the working-tree-clean
+# check until they reach the admit-budget closure stage Pulsar
+# v1.0.7 holds (admit 0/0 across 13 EC files).
+proofs/

BLOCKERS.md

@@ -1,13 +1,19 @@
 # Magnetar — Blockers to NIST MPTC submission
 
-> Honest enumeration of what blocks Magnetar from moving Tier B →
-> Tier A on the submission-readiness ladder.
+> Honest enumeration of what blocks Magnetar from moving toward
+> **full Tier A** (Pulsar-equivalent) on the submission-readiness
+> ladder.
 >
-> **As of v0.2.0**: Tier C → Tier B blockers (BLK-1, BLK-2, BLK-3)
-> are **CLOSED**. Tier B → A blockers (BLK-4 through BLK-9) are
-> partially or fully open; see status below. See `SPEC.md` for the
-> selected construction, `SUBMISSION-STATUS.md` for tier definitions
-> and the phased plan.
+> **As of v0.3.0**: Tier C → Tier B blockers (BLK-1, BLK-2, BLK-3)
+> are **CLOSED** at v0.2.0. BLK-5 (KAT vectors), BLK-8 (submission
+> package documentation shape) are **CLOSED** at v0.3.0. BLK-4
+> (reference impl + v0.4 lifecycle additions), BLK-6 (cross-validation
+> harness), BLK-7 (proof artifacts), BLK-9 (independent
+> cryptographer review) are partially or fully open; see status
+> below. See `SPEC.md` for the selected construction,
+> `SUBMISSION-STATUS.md` for tier definitions and the phased plan,
+> `CRYPTOGRAPHER-SIGN-OFF.md` Gates section for the full Tier A
+> gate inventory.
 
 ## Tier C → Tier B blockers (construction-level) — CLOSED v0.2.0
 
@@ -121,27 +127,58 @@ slhdsa.Verify — see `n1_byte_equality_test.go`.
 Multi-month research. Tier A submission depends on at least the
 EasyCrypt correctness theorem.
 
-### BLK-8 — Submission package documentation → **OPEN (depends on BLK-7)**
+### BLK-8 — Submission package documentation → **CLOSED v0.3.0 (documentation shape; supporting docs/* deferred)**
 
-**Status**: `SPEC.md` + `DEPLOYMENT-RUNBOOK.md` + `BLOCKERS.md` +
-`SUBMISSION-STATUS.md` ship in v0.2.0. The remaining 12 documents
-in the Pulsar template (NIST-SUBMISSION.md, PATENTS.md,
-PROOF-CLAIMS.md, AXIOM-INVENTORY.md, FIPS-TRACEABILITY.md,
-TRUSTED-COMPUTING-BASE.md, CHANGELOG.md, docs/* mirror) are
-deferred to the Tier A submission package. Several depend on
-BLK-7 outputs.
+**Resolution at v0.3.0**: the full 12-document Tier A submission
+package shape mirroring Pulsar's structure now ships:
 
-### BLK-9 — Independent cryptographer review → **OPEN**
+- ✅ `SUBMISSION.md` (cover sheet)
+- ✅ `NIST-SUBMISSION.md` (one-page executive summary)
+- ✅ `SPEC.md` (from v0.2.0)
+- ✅ `PATENTS.md` (royalty-free grant + defensive termination)
+- ✅ `PROOF-CLAIMS.md` (HONEST framing — narrow claim + 7 explicit non-claims)
+- ✅ `AXIOM-INVENTORY.md` (construction-level + implementation-level axioms with closure plans)
+- ✅ `FIPS-TRACEABILITY.md` (FIPS 205 § → code mapping)
+- ✅ `TRUSTED-COMPUTING-BASE.md` (TCB inventory)
+- ✅ `CRYPTOGRAPHER-SIGN-OFF.md` (internal review — APPROVED WITH GATES)
+- ✅ `CHANGELOG.md` (v0.3.0 entry)
+- ✅ `DEPLOYMENT-RUNBOOK.md` (from v0.2.0)
+- ✅ `BLOCKERS.md` (this file, v0.3.0 update)
+- ✅ `SUBMISSION-STATUS.md` (v0.3.0 update — Tier A doc shape complete)
 
-**Status**: no independent review of v0.2.0 has occurred.
+**What remains deferred to v0.4** (supporting docs/* — not
+required for Tier A documentation shape):
 
-**What's needed**: same model as Pulsar's
-`CRYPTOGRAPHER-SIGN-OFF.md` — independent reviewer attests
-construction + impl + proofs + tests. Output:
-`CRYPTOGRAPHER-SIGN-OFF.md` matching Pulsar's structure.
+- `docs/evaluation.md` — performance + correctness + KAT
+  cross-validation evidence
+- `docs/ietf-draft-skeleton.md` — IETF draft skeleton
+- `docs/nist-mptc-category.md` — Class N1 + N4-analog mapping
+- `docs/patent-claims.md` — attorney-prep claim drafts
+- `docs/design-decisions.md`, `docs/family-architecture.md`,
+  `docs/threat-model.md` — supporting design context
 
-Blocked on BLK-7 and BLK-8 being complete enough for the reviewer
-to evaluate the formal correctness + the submission package.
+These are tracked for the v0.4 release alongside ML-KEM envelope
+wrapping + reshare protocol.
+
+### BLK-9 — Independent cryptographer review → **PARTIAL: internal v0.3.0, external roadmap v0.6.0**
+
+**Resolution at v0.3.0 (internal)**: `CRYPTOGRAPHER-SIGN-OFF.md`
+landed. Internal cryptographer agent reviewed all 12 production
+Go source files (~2186 LOC) plus the test surface (~1451 LOC),
+verified build + vet + tests + coverage (76.8%), conducted real
+file:line citation of constant-time discipline + zeroize
+discipline + identifiable abort soundness. Verdict: **APPROVED
+WITH GATES**. Five open gates tracked (GATE-1 through GATE-5).
+
+**What remains (external, roadmap v0.6.0)**: independent lab
+engagement covering construction + implementation + EC theories
+(when they land v0.5.0) + dudect (when it lands v0.6.0). Output:
+external audit report alongside the internal sign-off.
+
+External engagement is blocked on:
+- GATE-1 / GATE-2 (EC theory shells + Lean ↔ EC bridge, v0.5.0)
+- GATE-3 (dudect 10⁹ samples, v0.6.0)
+- GATE-5 (v0.4 lifecycle additions for the deployment posture)
 
 ## Non-blockers
 

CHANGELOG.md

@@ -0,0 +1,177 @@
+# Changelog — Magnetar
+
+All notable changes to the Magnetar threshold SLH-DSA library and
+NIST MPTC submission package are tracked in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
+Magnetar adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+(Nothing pending at this writing.)
+
+## [0.3.0] — 2026-05-18 — Tier A documentation shape complete
+
+The full 12-document Tier A submission package shape now ships,
+mirroring Pulsar's structure. Internal cryptographer sign-off
+landed (APPROVED WITH GATES). Submission orchestration scripts
+landed.
+
+### Added
+
+- **`SUBMISSION.md`** — NIST MPTC cover sheet. Headline N1 claim:
+  Magnetar threshold signatures are byte-identical to single-party
+  FIPS 205 `slhdsa.SignDeterministic` on the reconstructed master
+  seed. Honest delta vs Pulsar (no EC/Lean/Jasmin yet for the
+  threshold overlay).
+- **`NIST-SUBMISSION.md`** — one-page executive summary mapped to
+  NIST IR 8214C requirements.
+- **`PATENTS.md`** — royalty-free patent grant + defensive
+  termination. Defensive scope extends to FIPS 205, FIPS 204,
+  FIPS 203, successors. Claims limited to Magnetar-novel lifecycle
+  additions.
+- **`PROOF-CLAIMS.md`** — narrow Class-N1 byte-equality claim;
+  §3 enumerates 7 explicit non-claims (mechanized refinement of
+  threshold overlay, post-quantum hardness beyond FIPS 205,
+  byte-equality with FIPS 204/R-LWE, dudect statistical CT,
+  covert channels, protocol-level adversarial robustness beyond
+  reveal-and-aggregate, external Lean theorems).
+- **`AXIOM-INVENTORY.md`** — construction-level + implementation-level
+  axioms with closure plans for the proof-tier roadmap.
+- **`FIPS-TRACEABILITY.md`** — FIPS 205 §10.1/10.2/10.3 → code map.
+  FIPS 202 + SP 800-185 cSHAKE256/KMAC256 customisation tags pinned
+  in `transcript.go`. Threshold overlay traces to `SPEC.md`
+  §3/§4/§6.
+- **`TRUSTED-COMPUTING-BASE.md`** — implementation TCB inventory.
+  `cloudflare/circl/sign/slhdsa` at the single-party FIPS 205 layer.
+  Aggregator process in TCB for the brief seed-reconstruction
+  window (v0.1 reveal-and-aggregate caveat). Comparison vs Pulsar
+  and Corona.
+- **`CRYPTOGRAPHER-SIGN-OFF.md`** — internal cryptographer agent
+  review. Conducted by direct reading of all 12 production Go
+  source files + test surface; verified build + vet + tests +
+  coverage (76.8%). Verdict: **APPROVED WITH GATES**. Five open
+  gates: GATE-1 (EC theory shells, v0.5.0), GATE-2 (Lean ↔ EC
+  bridge, v0.5.0), GATE-3 (dudect 10⁹ samples, v0.6.0), GATE-4
+  (external audit, v0.6.0), GATE-5 (v0.4 lifecycle additions).
+- **`scripts/cut-submission.sh`** — 8-step tarball cut.
+  Verifies clean tree + branch=main, runs high-assurance gate,
+  regenerates KATs via `ref/go/cmd/genkat` and verifies
+  byte-identical with committed `vectors/*.json`, runs core tests,
+  tars (excluding `.git` / `.claude` / `bench/results`), SHA-256s,
+  tags. Idempotent (refuses tag/tarball re-cut unless `--force`).
+  Dry-run mode for review.
+- **`scripts/check-high-assurance.sh`** — per-push gate. Runs `go
+  build` + `go vet` + secret-log grep + short test suite. HONEST
+  about absent gates (no EC/Lean/Jasmin theories for threshold
+  overlay; libjade covers FIPS 205 single-party but is not
+  redistributed). Honest scope documented in the script header.
+
+### Changed
+
+- **`README.md`** — flipped status to "Tier A documentation shape
+  complete". Updated "What v0.3.0 ships" / "does NOT yet ship"
+  to reflect the closed BLK-5/BLK-8 + the open gates per
+  `CRYPTOGRAPHER-SIGN-OFF.md`.
+- **`SUBMISSION-STATUS.md`** — promoted to Tier A documentation
+  shape; Phase 4 (submission package) marked CLOSED for doc shape;
+  Phase 5 (cryptographer review) marked PARTIAL (internal v0.3.0,
+  external roadmap v0.6.0).
+- **`BLOCKERS.md`** — closed BLK-8 (submission package documentation
+  shape) at v0.3.0; partially closed BLK-9 (internal review
+  landed; external roadmap v0.6.0). BLK-4 / BLK-6 / BLK-7 remain
+  open.
+
+### Honesty notes
+
+- The five open gates in `CRYPTOGRAPHER-SIGN-OFF.md` are
+  documentation + formal-methods + measurement + lifecycle
+  gates; none requires an algorithm or code change at v0.3.0.
+- `PROOF-CLAIMS.md` §3 enumerates 7 explicit non-claims; this
+  is the honest disclosure that the submission package surfaces
+  to NIST reviewers.
+- EC theory shells, Lean ↔ EC bridges, and Jasmin sources for
+  the threshold overlay are NOT in this submission. Pulsar at
+  v1.0.7 has 13/13 EC files compiling with admit 0/0; Magnetar's
+  comparable closure is roadmap v0.5.0 with cross-citation to
+  Pulsar's GF(257) Shamir / Lagrange bridges as the closure plan.
+
+## [0.2.0] — 2026-05-18 — Tier B: production library + submission scaffold
+
+First production-library release. Implements v0.1 reveal-and-aggregate
+threshold SLH-DSA over FIPS 205 with KAT-deterministic vectors and
+the honest trust-model disclosure.
+
+### Added
+
+- **`ref/go/pkg/magnetar/`** — production Go reference implementation
+  (~2186 LOC). Single-party + DKG + threshold-sign + Combine over
+  the SLH-DSA scheme seed. Three FIPS 205 parameter sets:
+  SHAKE-192s (recommended, NIST PQ Cat 3), SHAKE-192f (Cat 3 fast),
+  SHAKE-256s (Cat 5).
+- **`ref/go/cmd/genkat`** — deterministic KAT generator. Produces
+  byte-stable JSON output at five profiles (keygen, sign, verify,
+  threshold-sign, dkg). Re-running on a clean checkout produces
+  byte-identical vectors.
+- **`vectors/{keygen,sign,verify,threshold-sign,dkg}.json`** —
+  committed KAT vectors. KAT replay tests (`kat_test.go`) validate
+  the package implementation reproduces every entry verbatim.
+- **`n1_byte_equality_test.go`** — empirical N1 byte-equality
+  harness. Threshold-Combine output byte-identical to centralized
+  FIPS 205 `slhdsa.SignDeterministic` on the reconstructed master
+  seed. Tested at (3,2), (5,3), (7,4) committee/threshold
+  configurations.
+- **`SPEC.md`** — construction specification: notation, hash domain
+  separation, DKG protocol, threshold signing, Class-N1-analog
+  byte-equality claim, trust model, identifiable abort, parameter
+  sets.
+- **`DEPLOYMENT-RUNBOOK.md`** — operator-facing trust-model
+  disclosure. v0.1 reveal-and-aggregate aggregator-as-TCB caveat
+  documented with TEE / mlock / ptrace-off hardening matrix.
+- **`BLOCKERS.md`** — Tier B → A path enumeration (9 blockers,
+  3 closed at v0.2.0).
+- **`SUBMISSION-STATUS.md`** — NIST MPTC submission status; phased
+  plan to submission-readiness.
+- **`README.md`** — repo purpose + status (v0.2.0 = Tier B).
+
+### Closed (Tier C → Tier B)
+
+- **BLK-1**: construction selected (v0.1 reveal-and-aggregate over
+  the SLH-DSA scheme seed; mirrors Pulsar's v0.1 pattern).
+- **BLK-2**: academic basis (Shamir 1979 + reveal-and-aggregate
+  industry pattern; open citation gap noted).
+- **BLK-3**: spec defined (`SPEC.md`).
+- **BLK-5**: KAT vectors shipped + deterministic regeneration.
+
+### Honesty notes
+
+- The v0.1 reveal-and-aggregate trust caveat: the aggregator
+  process holds the reconstructed master SLH-DSA scheme seed in
+  memory for the duration of one `Combine` call. Same trust model
+  as Pulsar v0.1; documented honestly in `DEPLOYMENT-RUNBOOK.md`
+  with the TEE / mlock / ptrace-off hardening matrix.
+- v0.1 DKG envelopes are plaintext (KAT-deterministic). A passive
+  network observer can collect shares. v0.4 closes this channel
+  with ML-KEM-768 envelope wrapping (matching Pulsar CR-8).
+
+## [0.1.0] — 2026-05-18 — Tier C: research-stage
+
+Initial Magnetar research-stage commit.
+
+### Added
+
+- **`DESIGN.md`** — initial design notes for threshold SLH-DSA.
+- **`README.md`** — research-stage status.
+- **`LICENSE`** — BSD-3-Clause.
+
+---
+
+**Footer**
+
+This CHANGELOG covers the Magnetar library + NIST MPTC submission
+package. Sibling submissions:
+
+- `luxfi/pulsar` — M-LWE threshold ML-DSA-65 (FIPS 204 byte-equal),
+  Tier A reference at v1.0.7.
+- `luxfi/corona` — R-LWE threshold signature (Boschini ePrint
+  2024/1113), Tier A documentation shape at v0.6.0.

README.md

@@ -1,13 +1,19 @@
 # Magnetar — Threshold SLH-DSA (FIPS 205)
 
-> **Tier B: production library + submission scaffold landed v0.2.0.**
+> **Tier A documentation shape complete at v0.3.0.**
 > Threshold hash-based PQ signature primitive over FIPS 205 SLH-DSA
 > implementing the **v0.1 reveal-and-aggregate** construction.
-> Mechanized refinement + independent audit on the roadmap to Tier A.
+> The full 12-document Tier A submission package shape (mirroring
+> Pulsar's structure) is now in-tree; mechanized refinement, dudect
+> statistical CT validation, v0.4 lifecycle additions (ML-KEM
+> envelope wrap + reshare), and external audit are the remaining
+> gates to full Tier A — see `CRYPTOGRAPHER-SIGN-OFF.md` "Gates"
+> section.
 >
-> See `SPEC.md` for the construction specification,
+> See `SUBMISSION.md` for the NIST MPTC cover sheet,
+> `SPEC.md` for the construction specification,
 > `DEPLOYMENT-RUNBOOK.md` for the v0.1 trust-model disclosure,
-> `BLOCKERS.md` for the remaining Tier B → A path, and
+> `BLOCKERS.md` for the remaining gates to full Tier A, and
 > `SUBMISSION-STATUS.md` for the NIST MPTC roadmap.
 
 ## Status
@@ -18,27 +24,29 @@
 | Construction | v0.1 reveal-and-aggregate (Shamir VSS over the SLH-DSA scheme seed) |
 | Reference implementation | `ref/go/pkg/magnetar/` — pure Go, depends on `cloudflare/circl/sign/slhdsa` |
 | KAT vectors | `vectors/{keygen,sign,verify,threshold-sign,dkg}.json` (deterministic regeneration) |
-| Class-N1-analog claim | threshold signature is byte-equal to single-party `slhdsa.SignDeterministic` on the same reconstructed seed |
-| Submission package | NIST MPTC roadmap — see `SUBMISSION-STATUS.md` for the v0.3 target window |
+| Class-N1 claim | threshold signature is byte-identical to single-party `slhdsa.SignDeterministic` on the same reconstructed seed |
+| Submission package | **Tier A documentation shape complete (v0.3.0)** — `SUBMISSION.md`, `NIST-SUBMISSION.md`, `SPEC.md`, `PATENTS.md`, `PROOF-CLAIMS.md`, `AXIOM-INVENTORY.md`, `FIPS-TRACEABILITY.md`, `TRUSTED-COMPUTING-BASE.md`, `CRYPTOGRAPHER-SIGN-OFF.md`, `DEPLOYMENT-RUNBOOK.md`, `BLOCKERS.md`, `SUBMISSION-STATUS.md`. See `scripts/cut-submission.sh`. |
 | Cert-profile role | Polaris profile in `luxfi/quasar` (cross-family PQ diversity) |
-| Proof artifacts | None yet — see `BLOCKERS.md` BLK-7 |
-| Independent review | None yet — see `BLOCKERS.md` BLK-9 |
+| Proof artifacts | None yet for the threshold overlay — roadmap v0.5.0 (multi-month research). See `AXIOM-INVENTORY.md` §2. |
+| Independent review | Internal cryptographer sign-off at v0.3.0 (`CRYPTOGRAPHER-SIGN-OFF.md`); external audit roadmap v0.6.0. See `BLOCKERS.md` BLK-9. |
 
-## What v0.2.0 ships
+## What v0.3.0 ships (Tier A documentation shape complete)
 
-- **Reference implementation** (`ref/go/pkg/magnetar/`): single-party + DKG + threshold-sign + Combine over the SLH-DSA scheme seed.
+- **Reference implementation** (`ref/go/pkg/magnetar/`, ~2186 LOC): single-party + DKG + threshold-sign + Combine over the SLH-DSA scheme seed.
 - **Parameter sets**: SHAKE-192s (recommended), SHAKE-192f, SHAKE-256s.
 - **KAT generator** (`ref/go/cmd/genkat`): deterministic vectors at five profiles (keygen, sign, verify, threshold-sign, dkg). Re-running on a clean checkout produces byte-identical output.
-- **Headline test** (`n1_byte_equality_test.go`): threshold-produced signatures are byte-identical to single-party FIPS 205 `SignDeterministic` on the reconstructed master seed.
+- **Headline test** (`n1_byte_equality_test.go`): threshold-produced signatures are byte-identical to single-party FIPS 205 `SignDeterministic` on the reconstructed master seed across (3,2), (5,3), (7,4) configurations.
 - **Honest trust-model disclosure**: `DEPLOYMENT-RUNBOOK.md` documents the v0.1 reveal-and-aggregate aggregator-as-TCB caveat with the same rigor as Pulsar's.
+- **Full Tier A documentation shape**: `SUBMISSION.md`, `NIST-SUBMISSION.md`, `PATENTS.md`, `PROOF-CLAIMS.md`, `AXIOM-INVENTORY.md`, `FIPS-TRACEABILITY.md`, `TRUSTED-COMPUTING-BASE.md`, `CRYPTOGRAPHER-SIGN-OFF.md` (mirroring Pulsar's 12-doc structure).
+- **Submission orchestration**: `scripts/cut-submission.sh` + `scripts/check-high-assurance.sh`.
 
-## What v0.2.0 does NOT yet ship
+## What v0.3.0 does NOT yet ship (open gates to full Tier A)
 
-- Formal proofs (EasyCrypt theories, Lean bridges, Jasmin sources) — see `BLOCKERS.md` BLK-7.
-- Constant-time analysis under `dudect` of the threshold layer — see `BLOCKERS.md` BLK-7.
-- ML-KEM-768 wrapping of DKG Round-1 envelopes (closes passive-network-observer channel) — planned for v0.3 / Pulsar parity.
-- Independent cryptographer sign-off — see `BLOCKERS.md` BLK-9.
-- Full 16-document submission package — see `BLOCKERS.md` BLK-8.
+- Formal proofs (EasyCrypt theory shells for the threshold overlay, Lean ↔ EC bridges) — see `BLOCKERS.md` BLK-7 + `CRYPTOGRAPHER-SIGN-OFF.md` GATE-1 / GATE-2. **Roadmap v0.5.0; multi-month research.**
+- Constant-time analysis under `dudect` of the threshold layer — see `CRYPTOGRAPHER-SIGN-OFF.md` GATE-3. **Roadmap v0.6.0.**
+- ML-KEM-768 wrapping of DKG Round-1 envelopes (closes passive-network-observer channel) — see `BLOCKERS.md` BLK-4. **Roadmap v0.4.0.**
+- Reshare protocol (Refresh + ReshareToNewSet) for Class N4-analog evidence — see `BLOCKERS.md` BLK-4. **Roadmap v0.4.0.**
+- External cryptographer audit — see `BLOCKERS.md` BLK-9 + `CRYPTOGRAPHER-SIGN-OFF.md` GATE-4. **Roadmap v0.6.0.**
 
 ## Where this is used
 

SUBMISSION-STATUS.md

@@ -1,15 +1,17 @@
 # NIST MPTC Submission Status — Magnetar
 
 > Honest status of Magnetar's path to NIST Multi-Party Threshold
-> Cryptography submission. **Tier B** as of v0.2.0
-> (production library + submission scaffold shipped). Mechanized
-> refinement + independent audit on the roadmap to Tier A.
+> Cryptography submission. **Tier A documentation shape complete**
+> as of v0.3.0. Mechanized refinement, dudect, v0.4 lifecycle
+> additions (ML-KEM envelope wrap + reshare), and external audit
+> are the remaining gates to **full Tier A**.
 
-## Today (v0.2.0)
+## Today (v0.3.0)
 
-**Tier B: production library + submission scaffold landed.**
+**Tier A documentation shape complete; full Tier A formal-methods
++ measurement + lifecycle gates open.**
 
-Specifically:
+Specifically (carried forward from v0.2.0 and extended at v0.3.0):
 
 - **Construction selected.** v0.1 reveal-and-aggregate over the
   SLH-DSA scheme seed (Shamir VSS in GF(257), Lagrange
@@ -18,30 +20,50 @@ Specifically:
 - **Reference implementation shipped.** `ref/go/pkg/magnetar/` —
   pure Go on top of `cloudflare/circl/sign/slhdsa`. Single-party
   + DKG + threshold-sign + Combine. Three parameter sets
-  (SHAKE-192s / SHAKE-192f / SHAKE-256s).
+  (SHAKE-192s / SHAKE-192f / SHAKE-256s). ~2186 LOC production
+  Go, 76.8% test coverage.
 - **KAT vectors shipped.** `vectors/{keygen,sign,verify,
   threshold-sign,dkg}.json` — deterministic regeneration via
-  `cmd/genkat`.
-- **Class-N1-analog evidence shipped.**
+  `ref/go/cmd/genkat`.
+- **Class-N1 evidence shipped.**
   `n1_byte_equality_test.go` — threshold-produced signatures are
   byte-identical to single-party `slhdsa.SignDeterministic` on
-  the reconstructed master seed; verifies under unmodified
-  FIPS 205.
+  the reconstructed master seed across (3,2), (5,3), (7,4)
+  configurations; verifies under unmodified FIPS 205.
 - **Honest trust-model disclosure shipped.**
   `DEPLOYMENT-RUNBOOK.md` documents the v0.1 reveal-and-aggregate
   aggregator-as-TCB caveat with the same rigor as Pulsar's.
+- **Tier A documentation shape complete (v0.3.0).** Full 12-document
+  submission package shape, mirroring Pulsar's structure:
+  `SUBMISSION.md`, `NIST-SUBMISSION.md`, `SPEC.md`, `PATENTS.md`,
+  `PROOF-CLAIMS.md`, `AXIOM-INVENTORY.md`, `FIPS-TRACEABILITY.md`,
+  `TRUSTED-COMPUTING-BASE.md`, `CRYPTOGRAPHER-SIGN-OFF.md`,
+  `DEPLOYMENT-RUNBOOK.md`, `BLOCKERS.md`, `SUBMISSION-STATUS.md`.
+- **Internal cryptographer sign-off shipped (v0.3.0).**
+  `CRYPTOGRAPHER-SIGN-OFF.md` — APPROVED WITH GATES, mirroring
+  Pulsar's exact structure. Five open gates tracked.
+- **Submission orchestration shipped (v0.3.0).**
+  `scripts/cut-submission.sh` (8-step tarball cut with KAT-determinism
+  verification) + `scripts/check-high-assurance.sh` (per-push gate).
 
-What is **NOT** yet shipped (the Tier B → A gap):
+What is **NOT** yet shipped (the gates to full Tier A — tracked
+in `CRYPTOGRAPHER-SIGN-OFF.md` Gates section):
 
-- **Proof artifacts** (EasyCrypt theories, Lean bridges, Jasmin
-  sources). See `BLOCKERS.md` BLK-7. This is multi-month research.
-- **Constant-time analysis** of the threshold layer under `dudect`
-  or formal tooling.
-- **ML-KEM-768 wrapping** of DKG Round-1 envelopes (closes
-  passive-network-observer channel). v0.1 envelopes are plaintext.
-- **Independent cryptographer review.** See `BLOCKERS.md` BLK-9.
-- **Full 16-document submission package** mirroring Pulsar's
-  layout. See `BLOCKERS.md` BLK-8.
+- **GATE-1: EC theory shells for the threshold overlay**. The
+  single-party FIPS 205 layer is NIST-anchored; the threshold
+  overlay is novel. Cross-citation to Pulsar's Lean ↔ EC bridges
+  for the GF(257) Shamir / Lagrange algebraic identities; new EC
+  theory shells needed for the cSHAKE256 mix + `KeyFromSeed →
+  SignDeterministic` dispatch. **Roadmap v0.5.0; multi-month research.**
+- **GATE-2: Lean ↔ EC bridge**. Cross-citation closure to Pulsar's
+  bridges. **Roadmap v0.5.0.**
+- **GATE-3: dudect 10⁹ samples on the threshold overlay**.
+  **Roadmap v0.6.0.**
+- **GATE-4: external cryptographer audit**. **Roadmap v0.6.0.**
+- **GATE-5: v0.4 lifecycle additions**. ML-KEM-768 wrapping of
+  DKG Round-1 envelopes (closes passive-network-observer channel)
+  + Reshare protocol (Refresh + ReshareToNewSet) for Class N4-analog
+  evidence. **Roadmap v0.4.0.**
 
 ## Why this is not Pulsar (still, at Tier B)
 
@@ -91,25 +113,31 @@ submission-package authoring + parallel independent review.
 - Jasmin constant-time analysis of the threshold layer (DKG / Combine / Round1 / Round2)
 - Output target: `proofs/`, `jasmin/`
 
-### Phase 4 — Submission package (OPEN, BLK-8)
+### Phase 4 — Submission package (CLOSED v0.3.0 for documentation shape; full Tier A formal-methods gates open)
 
-Mirror Pulsar's 16-doc structure adapted to Magnetar's specifics:
+Mirror Pulsar's 12-doc structure adapted to Magnetar's specifics:
 
-- `SUBMISSION.md`, `NIST-SUBMISSION.md`, `SPEC.md`
-- `PATENTS.md`, `PROOF-CLAIMS.md`, `AXIOM-INVENTORY.md`,
-  `FIPS-TRACEABILITY.md`, `TRUSTED-COMPUTING-BASE.md`
-- `CHANGELOG.md`, `DEPLOYMENT-RUNBOOK.md` (✅ landed v0.2.0)
-- `docs/{evaluation,nist-mptc-category,design-decisions,
+- ✅ `SUBMISSION.md`, `NIST-SUBMISSION.md`, `SPEC.md` (landed v0.3.0)
+- ✅ `PATENTS.md`, `PROOF-CLAIMS.md`, `AXIOM-INVENTORY.md`,
+  `FIPS-TRACEABILITY.md`, `TRUSTED-COMPUTING-BASE.md` (landed v0.3.0)
+- ✅ `CHANGELOG.md` (landed v0.3.0), `DEPLOYMENT-RUNBOOK.md` (landed v0.2.0)
+- ✅ `CRYPTOGRAPHER-SIGN-OFF.md` (landed v0.3.0, APPROVED WITH GATES)
+- ✅ `scripts/cut-submission.sh` + `scripts/check-high-assurance.sh`
+  (landed v0.3.0)
+- ⏳ `docs/{evaluation,nist-mptc-category,design-decisions,
   patent-claims,family-architecture,threat-model,
-  ietf-draft-skeleton}.md`
-- `scripts/cut-submission.sh` + supporting build/test/bench/vector
-  generation scripts
+  ietf-draft-skeleton}.md` — supporting docs (parallel to
+  Pulsar's `docs/`; deferred to v0.4 — not required for
+  Tier A documentation shape)
 
-### Phase 5 — Independent cryptographer review (OPEN, BLK-9)
+### Phase 5 — Independent cryptographer review (PARTIAL: internal v0.3.0; external roadmap v0.6.0)
 
-- Same model as Pulsar's `CRYPTOGRAPHER-SIGN-OFF.md`
-- Independent reviewer attests construction + impl + proofs + tests
-- Output: `CRYPTOGRAPHER-SIGN-OFF.md`
+- ✅ **Internal review (v0.3.0)**: `CRYPTOGRAPHER-SIGN-OFF.md`
+  signed off by the internal cryptographer agent. Verdict:
+  APPROVED WITH GATES. Five gates tracked.
+- ⏳ **External engagement (roadmap v0.6.0)**: independent lab
+  audit covering construction + implementation + EC theories (when
+  they land v0.5.0) + dudect (when it lands v0.6.0).
 
 ## Target
 
@@ -129,22 +157,29 @@ Mirror Pulsar's 16-doc structure adapted to Magnetar's specifics:
   submission package to mirror at Phase 4
 - [`luxfi/lps/ROADMAP-CRYPTO-STACK.md`](https://github.com/luxfi/LPs/blob/main/ROADMAP-CRYPTO-STACK.md) — multi-year crypto stack plan
 
-## Honest non-claims (at Tier B)
+## Honest non-claims (at Tier A documentation shape; v0.3.0)
 
-Magnetar v0.2.0 today is NOT:
+Magnetar v0.3.0 today is NOT:
 
-- A NIST MPTC submission (won't be until Tier A, target 2027 Q3)
+- A submitted NIST MPTC entry (the tarball cut tool is in place
+  via `scripts/cut-submission.sh`; cut target is the
+  `submission-2026-11-16` window; Lux internal target is 2027 Q3)
 - A production cryptographic primitive **without** the v0.1
   reveal-and-aggregate trust caveat (aggregator is TCB; see
   `DEPLOYMENT-RUNBOOK.md`)
-- A formally verified scheme (no EasyCrypt / Lean / Jasmin yet)
-- Independently reviewed (no cryptographer sign-off yet)
+- A formally verified scheme **at the threshold overlay layer**
+  (FIPS 205 single-party is NIST-anchored; threshold overlay
+  EC theory shells are roadmap v0.5.0)
+- Externally audited (internal cryptographer sign-off only at
+  v0.3.0; external lab engagement is roadmap v0.6.0)
 - A drop-in replacement for Pulsar (Pulsar M-LWE is the
   production cert-profile target; Magnetar is the cross-family
   diversity leg in the Polaris profile)
 
-This repo now exists as a **production library** for v0.1
-reveal-and-aggregate threshold SLH-DSA, with the honest trust
-caveat documented operationally. The path to Tier A
-(formal verification + independent review + full submission
-package) is on the NIST MPTC v0.3 roadmap.
+This repo now exists as a **production library + Tier A
+documentation shape complete** for v0.1 reveal-and-aggregate
+threshold SLH-DSA, with the honest trust caveat documented
+operationally. The path to **full Tier A** (mechanized refinement
++ dudect + v0.4 lifecycle + external audit) is tracked on the
+v0.4 / v0.5 / v0.6 roadmap, with closure plans documented in
+`CRYPTOGRAPHER-SIGN-OFF.md` Gates section.