docs: VERSIONS + CHANGELOG — keygen is dealerless (RSS), not trusted-dealer

The keygen-track tables claimed 'KEYGEN stays trusted-dealer (Residual B)' and
'Dealerless byte-FIPS-204 KEY DKG | PROVEN UNREACHABLE' — both false since v0.6.0.
Corrected to the accurate scoped truth: dealerless committee keygen via Mithril
RSS (mithril_rss.go) is the production keygen, standard-verifier-compatible
(proven); only the NAIVE additive S_eta lift is unreachable (not a class
impossibility — RSS is the published escape). Added v0.6.0-v0.6.3 + HYPERBALL
signer to the version ledger. Distribution-equivalence stays a labeled residual.
Docs-only; matches PULSAR.md (e5b6d6e).

CHANGELOG.md

@@ -39,16 +39,23 @@ layer is unbuilt.
   (`TestCSCP_WrongW1_CaughtByFindHint`). This is the open **Residual A** (the
   CSCP malicious-secure / identifiable-abort layer + a networked,
   non-simulation MPC deployment).
-- **KEYGEN stays trusted-dealer (Residual B).** Dealerless byte-FIPS-204 KEY
-  DKG is *proven unreachable*: FIPS-204 KeyGen samples `s1,s2` from
-  `S_η = {p : ‖p‖∞ ≤ η}`, but a dealerless sum/Lagrange combination of N ≥ 2
-  contributions has ℓ∞-support up to `N·η > η`, breaking BCC byte-validity
-  (`‖c·s2‖∞ ≤ N·β > β`) and the FIPS-204 security-equivalence
-  (`distributed_bcc_dkg.go` returns `ErrDealerlessByteFIPSUnreachable`). KEYGEN
-  therefore stays trusted-dealer (`DealAlgShares`); the
-  **permissionless-public guarantee is carried by Corona** (natively dealerless
-  via Pedersen DKG over `R_q`), composed alongside Pulsar in the Quasar AND-mode
-  dual-PQ cert.
+- **KEYGEN is now DEALERLESS (RSS) — the dealer is dead at keygen (v0.6.0+).**
+  Superseded the earlier "trusted-dealer / Residual B" status. Only the NAIVE
+  additive lift is unreachable: a naive sum/Lagrange of N ≥ 2 `S_η` contributions
+  has ℓ∞-support up to `N·η > η`, breaking BCC byte-validity (`‖c·s2‖∞ ≤ N·β > β`)
+  — `naive_additive_seta_obstruction.go` returns `ErrDealerlessByteFIPSUnreachable`
+  for THAT construction only, **not as a class impossibility**. The published
+  escape is **Mithril short replicated secret sharing** (`mithril_rss.go`
+  `MithrilRSSKeygen`): committee keygen with no dealer and no centralized
+  reconstruction, whose group key signs under **stock unmodified** `mldsa65.Verify`
+  (gold-proof at (t=8,n=8), (t=16,n=16), and all small committees `N≤6`;
+  `accumulateSubset` per-subset reduction unblocks large committees, v0.6.3). The
+  HYPERBALL 3-round signer (`mithril_rss_hyperball.go`) is the Mithril-native
+  no-reconstruct signer over that key. **Scope:** standard-verifier-compatible is
+  PROVEN; full FIPS-204 KeyGen-distribution-equivalence (simulation/hiding/
+  abort-bias) remains a labeled residual. The dealerless **Corona** leg (Pedersen
+  DKG over `R_q`) continues to carry permissionless-public safety alongside Pulsar
+  in the Quasar AND-mode dual-PQ cert.
 
 ## v1.1.0 – v1.1.5 — BCC/CEF byte-equal threshold ML-DSA + honest-status hardening
 

ref/go/pkg/pulsar/VERSIONS.md

@@ -11,19 +11,25 @@
 | **v0.3 — algebraic broadcast** | **REMOVED** | The `AlgebraicAggregate` path broadcast per-party `c·s2` / `c·t0` residual shares and reconstructed the leaking `MakeHint` residual at the aggregator. | Closed as **PULSAR-V13-HINT-LEAK** — broadcasting those shares leaks the long-term key. Ripped out (commit `b185533`); **no backward-compatible re-entry**. |
 | **v0.4 — BCC/CSCP no-reconstruct** | **CURRENT (production sign path)** | Boundary-Cleared Carry-elimination (BCC/CEF) + Comparison-Secure-Comparison-Protocol (CSCP). Each validator holds exactly one poly-vector Shamir share of `s1`; signing aggregates only masked `z`-partials; the hint is recovered from the **public** `w' = A·z − c·t1·2^d` and `w1`. No process forms `s1`, the seed, `sk`, `c·s2`, `c·t0`, `r0`, or full `w`. Output verifies under unmodified FIPS 204 ML-DSA (`mldsa{65,87}.Verify`). | Base `main` @ `v0.4.0` (commit `b652893`). The sole production path. |
 | **v0.5.0 — malicious-hardening** | **MERGED (`main` @ `53ed1c2`, RED-verified 0 crit/high)** | Hardens v0.4 from semi-honest/no-leak toward **malicious** security: nonce single-use **safe by construction** (per-share registry, default-path enforced; `w1`-only dedup closes cross-committee reuse), **authenticated-PartyID blame** (forged victim-slot partials dropped before attribution; blame gated on identity-signature validity — an attacker cannot frame/exclude an honest victim), identifiable-abort plumbing (duplicate-PartyID rejection, invalid/malformed blame, per-party commitment binding), GATE-2 reachability **+ indirection lint**, CI invariant against `legacy_trusted_dealer` in the prod build. | Merged off `harden/malicious-security`. Still **malicious-HARDENED, not fully-malicious-secure-PROVEN** (see scope). |
-| **v0.5.1 — post-merge hardening** | **CURRENT (`main`)** | Closes 3 RED post-merge nits (all liveness/availability, no forgery/leak): **(1) origin-auth SAFE-BY-DEFAULT** — `AggregateBCC{,WithBlame}` now REFUSE FAIL-CLOSED (`ErrOriginAuthRequired`) when no verifier is wired, instead of silently aggregating unauthenticated partials; the unauthenticated path is reachable ONLY via the explicit `UnauthenticatedAggregation` opt-out (trusted-channel/test). **(2) epoch-pruned nonce ledger** — `(*InMemoryNonceLedger).PruneBefore` + registry sweep `PruneShareLedgers` bound the single-use map to a sliding retained-epoch window, never reopening reuse inside the live window. **(3) CI no-asm/no-cgo assertion** — `TestCI_NoAssemblyOrCgoFiles` seals GATE-C's blind spot (the AST gates cannot model `.s`/`.c`/cgo) by proving the package is pure Go. | Same honest scope as v0.5.0 — no new "proven" claim. RED re-reviews. |
+| **v0.5.1 — post-merge hardening** | **MERGED (`main`)** | Closes 3 RED post-merge nits (all liveness/availability, no forgery/leak): **(1) origin-auth SAFE-BY-DEFAULT** — `AggregateBCC{,WithBlame}` now REFUSE FAIL-CLOSED (`ErrOriginAuthRequired`) when no verifier is wired, instead of silently aggregating unauthenticated partials; the unauthenticated path is reachable ONLY via the explicit `UnauthenticatedAggregation` opt-out (trusted-channel/test). **(2) epoch-pruned nonce ledger** — `(*InMemoryNonceLedger).PruneBefore` + registry sweep `PruneShareLedgers` bound the single-use map to a sliding retained-epoch window, never reopening reuse inside the live window. **(3) CI no-asm/no-cgo assertion** — `TestCI_NoAssemblyOrCgoFiles` seals GATE-C's blind spot (the AST gates cannot model `.s`/`.c`/cgo) by proving the package is pure Go. | Same honest scope as v0.5.0 — no new "proven" claim. |
+| **v0.6.0 — dealerless RSS keygen** | **MERGED (`main`) — the dealer is dead at keygen** | Mithril short replicated-secret-sharing committee keygen (`mithril_rss.go`); see the keygen track below. Completes the dealerless story: SIGNING no-reconstruct (v0.4/v0.5) + KEYGEN dealerless (RSS). | Standard-verifier-compatible; distribution-equivalence is a labeled residual. |
+| **HYPERBALL — Mithril 3-round no-reconstruct signer** | **MERGED (`main`, gates 5/6)** | `mithril_rss_hyperball.go` `SignHyperball`: 3-round no-reconstruct threshold signer over the RSS key — `z_j = y_j + c·s1_(j)`, no party/coordinator forms `s1`/`s2`/`y`/`w0`/`sk`; the secret mask `y` is never serialised onto the wire. Verifies under stock circl (`TestHyperballStockCirclVerify`); structural no-reconstruct proven by AST (`TestHyperballNoReconstructStructural`); fail-closed (GATE-6). | The Mithril-native signer complementing the RSS keygen; same standard-verifier boundary. |
+| **v0.6.1 / v0.6.2 — mlwe de-dup** | **MERGED (`main`, byte-preserving)** | Pulsar routed transcript→`mlwe/transcript`, Shamir→`mlwe/share`, samplers→`mlwe/sample/shake`, ring→`mlwe/ring/mldsa` (deleted duplicate zeta tables + samplers). Golden KAT vectors UNCHANGED; one-and-one-way DRY with Corona. | No wire/modulus/vector change; signing math untouched. |
+| **v0.6.3 — RSS overflow fix** | **CURRENT (`main`)** | `accumulateSubset` reduces mod q per-subset in RSS keygen — fixes the uint32 overflow at `C(N,M) ≥ ⌊2³²/q⌋ = 512` that produced unsignable wall keys for large committees (n=16,t=14, C=560). modQ is an additive homomorphism → bit-identical for small committees (n≤8). | Single-file keygen-correctness fix; golden KATs unchanged. |
 
 ## Keygen / nonce-gen track (separate from the sign path)
 
-The no-reconstruct property above is a **SIGN-time** property. Key and nonce
-*generation* are a distinct axis with its own honest scope:
+The no-reconstruct property above is a **SIGN-time** property. **As of v0.6.0,
+committee KEY generation is ALSO dealerless** (Mithril RSS, below) — so the
+trusted dealer is dead at both ends. Nonce *generation* remains a distinct axis
+(leak-free NonceMPC is still a residual):
 
 | Track | Status | Notes |
 |---|---|---|
 | **Trusted-dealer bootstrap** (`DealAlgShares`) | **TEST/BOOTSTRAP ONLY — quarantined** | Expands the seed once and Shamir-shares `s1`, then wipes. Confined to `bootstrap_dealer_test.go` (a `_test.go` file → **uncompilable into any production binary**). It seeds the no-reconstruct SIGNING tests; it is **not** a production keygen. |
 | **Legacy GF(q) seed-share committee** (`large_*.go`, `largeshamir.go`) | **QUARANTINED behind `//go:build legacy_trusted_dealer`** | `LargeCombine` reconstructs the master seed at sign time (the H-1 footgun). **Absent from the default build.** Item-4 CI invariant asserts the production build never ships this tag. |
-| **Pedersen-VSS dealerless exploration** | **SEPARATE BRANCH** `feat/v02-pedersen-vss-no-reconstruct` | The dealerless-keygen research track. Not on `main`; not part of the v0.4 production claim. |
-| **Dealerless byte-FIPS-204 KEY DKG** | **PROVEN UNREACHABLE (parameter obstruction)** | `naive_additive_seta_obstruction.go` → `ErrDealerlessByteFIPSUnreachable`: a dealerless sum of `S_η` shares has `‖·‖∞ ≤ N·η > η`, breaking BCC and FIPS-204 byte equality. Permissionless safety is carried by the dealerless **Corona** leg of the Quasar AND-mode cert, not by this keygen. |
+| **Dealerless RSS committee KEYGEN (Mithril)** | **CURRENT (`main` @ v0.6.0+) — the dealer is dead at keygen** | `mithril_rss.go` `MithrilRSSKeygen`: dealerless committee key generation via Mithril short replicated secret sharing (no dealer, no centralized reconstruction). Each committee's RSS-generated group key signs under **stock unmodified** `mldsa65.Verify` — gold-proof verified at (t=8,n=8), (t=16,n=16), and all small committees `T=2..N, N=2..6` via real per-party rejection sampling (`TestMithrilRSSStockCirclVerify`, `TestMithrilRSS_LargeN_StockCircl`). v0.6.3 `accumulateSubset` per-subset mod-q reduction unblocks large committees (n=16,t=14, C(16,3)=560 — the uint32 overflow at C≥512). **Scope:** standard-verifier-compatible (PROVEN). Full FIPS-204 KeyGen-distribution-equivalence (simulation/hiding-vs-<t/abort-bias) remains a labeled residual (R1). |
+| **NAIVE additive S_η dealerless keygen** | **UNSOUND (parameter obstruction — naive construction ONLY)** | `naive_additive_seta_obstruction.go` → `ErrDealerlessByteFIPSUnreachable`: a NAIVE Pedersen/Gennaro sum of `S_η` shares has `‖·‖∞ ≤ N·η > η`, breaking BCC and FIPS-204 byte equality. This is the naive lift ONLY — **NOT a class impossibility**: Mithril short-replicated-shares (above) is the published escape and is now the production dealerless keygen. The old `feat/v02-pedersen-vss-no-reconstruct` branch was the exploration; RSS superseded it. |
 | **NonceMPC (leak-free distributed nonce)** | **STAND-IN today** (`DealNonceMPCDebug`) | The production sign path consumes a `NonceCert` (only `w1` public). The stand-in dealer-models the nonce and exposes `DebugW` to the **test harness only** (never on the wire) — the **PULSAR-V13-W-LEAK** residual. The leak-free distributed nonce (HighBits-over-shares MPC / exact-ℓ∞ boundary ZK) is fail-closed behind the same wall as `rangeproof.go`. |
 
 ## Malicious-hardening status (this branch — honest implemented-vs-residual)