CIP-24: Cowboy Secret Service (CBSS)

​

1. Abstract

1. plaintext is never visible on chain or to validators,
2. secrets can be deleted forever (no archival ciphertext that becomes decryptable as cryptography ages),
3. only the specific keys an actor names at the call site are released to the runner,
4. release is just-in-time and the dispatcher is not in the trust path,
5. cross-account sharing is supported, and
6. the trust root is t-of-n proxy non-collusion, not a hardware enclave.

​

2. Motivation

​

2.1 The problem

• Validator privacy: validators replay actor execution; anything readable in the PVM is readable on chain.
• Eventual decryptability: anything written to chain history is decryptable forever as cryptography ages. Secrets leak retroactively.
• Runtime isolation: an actor that can read OPENAI_API_KEY should not also be able to read STRIPE_LIVE_KEY just because the same account owns both.
• Dispatcher trust: a dispatcher that can unwrap credentials or volume DEKs becomes a plaintext custodian. CBSS keeps the dispatcher off the key path for both.

​

2.2 Design philosophy

​

2.3 Why not TEE-rooted release

​

3. Specification

​

3.1 New data structures

​

SecretId

SecretId {
    account:   Address
    key_hash:  Bytes32             // == keccak256(account || key_name); chain never sees plaintext key_name
}

​

SecretKeyRef

SecretKeyRef {
    account:   Address (20 bytes)
    key_hash:  [u8; 32]
}

key_hash = keccak256( account || key_name )   // byte-identical to SecretId's key_hash recipe above — same inputs, same order, no separator

​

SecretMetadata

SecretMetadata {
    id:                SecretId
    latest_version:    u64
    active_versions:   Vec<u64>                    // index of currently-active version numbers (NOT inlined SecretVersion records); each version's full state lives at secret_version:{account}:{H_key}:{version_be8}. Pruned per MAX_VERSIONS_PER_SECRET.
    created_at:        BlockHeight
    last_updated_at:   BlockHeight
}

​

SecretVersionHighWaterMark

​

SecretVersion

SecretVersion {
    version:         u64
    pending:         bool                 // true between SetSecret(override-path) and FinalizeSecretVersion; false otherwise. Release attempts on pending versions fail with SecretPending.
    recipient:       ReleaseKeyRef        // always set; points to AccountReleaseKey (default) or per-secret SecretReleaseKey (override). For override path, the SecretReleaseKey may not exist yet (DkgPending) until RotateCommittee commits it.
    policy:          SecretPolicy         // always set
    // The following three fields are populated when pending=false. On the override path they are None at SetSecret time and filled in by FinalizeSecretVersion. Default-path SetSecret populates them immediately.
    wrap_epoch:      Option<u64>          // committee_epoch at the time this version was wrapped; IMMUTABLE once set
    cbfs_pointer:    Option<CbfsPointer>  // CIP-9 envelope; private volume. The CIP-9 envelope carries the outer DEK→plaintext encryption's nonce/AAD bytes (CBSS does not duplicate them here), but their value is fixed by this CIP: the outer AAD MUST equal the extended U-bound aad of §3.4.3 step 4 (see step 5).
    wrapped_dek:     Option<WrappedDek>   // single envelope (DEK encrypted under IBE-derived K); WrappedDek carries its own nonce, ephemeral_u, and aad (see §3.5). aad is canonically derivable from (account, key_hash, version, wrap_epoch, ephemeral_u) so SecretVersion does not store it separately.
    created_at:      BlockHeight
    creator_sig:     Bytes                // tx-level sender signature is the source of truth; the chain records the signing block and signer in event metadata. NO separate finalizer_sig — FinalizeSecretVersion is itself a tx and its sender signature serves the same role.
}

// Invariant: pending == true ⇔ wrap_epoch.is_none() ⇔ cbfs_pointer.is_none() ⇔ wrapped_dek.is_none()
// On override-path SetSecret: pending = true and ALL three Option fields are None until FinalizeSecretVersion lands. wrap_epoch is set THEN, not at SetSecret time.

enum ReleaseKeyRef {
    Account(Address),                     // wraps under AccountReleaseKey[Address].mpk (default path)
    SecretSpecific(SecretId, u64),        // wraps under SecretReleaseKey[(SecretId, version)].mpk (override path)
}

​

SecretPolicy

SecretPolicy {
    actors:        Option<Vec<ActorAddress>>     // None = all of owner's actors at release time
    tee_required:  bool                          // additional gate; layered on top of threshold release
}

​

AccountReleaseKey (default path)

AccountReleaseKey {
    account:              Address
    mpk:                  G2Point                  // BLS12-381 G2, 96 B compressed (master public key); preserved across reshare
    committee:            Vec<ProxyId>             // current committee, exactly `n` distinct entries; mutable on reshare
    threshold:            u8                       // `t`, with 1 ≤ t ≤ n
    committee_epoch:      u64                      // increments on each successful reshare; tracks share-polynomial version, NOT ciphertext binding
    last_reshare_block:   BlockHeight
    vss_commitments:      Vec<G2Point>             // per-proxy VSS commitments S_i = s_i · G2 under the current committee_epoch; n entries
}

​

SecretReleaseKey (override path)

SecretReleaseKey {
    secret_id:            SecretId
    version:              u64
    mpk:                  G2Point
    committee:            Vec<ProxyId>             // exactly `n` distinct entries
    threshold:            u8
    committee_epoch:      u64
    last_reshare_block:   BlockHeight
    vss_commitments:      Vec<G2Point>
}

​

CbssProxy

CbssProxy {
    id:               ProxyId
    operator:         Address
    pubkey:           PublicKey                 // secp256k1; used for runner→proxy authentication
    hpke_pubkey:      HpkePublicKey             // X25519 HPKE key used for recipient-specific DKG/reshare payloads
    tls_spki:         Bytes                     // DER SubjectPublicKeyInfo pin for QUIC TLS verification
    network_addr:     NodeAddr                  // QUIC endpoint
    stake:            U256                      // CBY wei; ≥ MIN_PROXY_STAKE
    registered_at:    BlockHeight
    eligible_after:   BlockHeight               // registered_at + PROXY_SOAK_PERIOD
    health:           ProxyHealth               // updated by liveness pings; affects VRF weight
    suspended:        bool                      // true while a slashing case is open
    unbond_at:        Option<BlockHeight>       // Some iff DeregisterCbssProxy called
}

​

WrappedDek (IBE envelope)

WrappedDek {
    version:      u8           // format-version tag == 2 (WRAPPED_DEK_FORMAT_VERSION); leading byte/field of every serialization
    ciphertext:   Bytes        // AES-256-GCM(K, DEK, nonce, aad)
    nonce:        [u8; 12]
    ephemeral_u:  [u8; 96]     // = compress(U), U = r · G2_gen ∈ G2; canonical compressed BLS12-381 G2 encoding, length-validated
    aad:          Bytes        // == u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 || ephemeral_u
}

aad == u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 || ephemeral_u

​

3.2 Storage layout in 0x04

1. CLI / SDK input (the user types OPENAI_API_KEY into cowboy secrets set).
2. Actor manifest entitlements (secrets.read.keys: [...]). Manifests are owner-deployed and validated by the chain; their entitlement keys are visible to validators, indexers, and any node that fetches the manifest. Owners who require unguessable key names should use random suffixes there too (see §5.1).
3. The runner sandbox during a single runner-op (as the substituted plaintext value’s identifier).

secret:                         + account[20] + key_hash[32]              → SecretMetadata
secret_version_hwm:             + account[20] + key_hash[32]              → u64 allocation floor
secret_version:                 + account[20] + key_hash[32] + version[8] → SecretVersion
secret_version_tombstone:       + account[20] + key_hash[32] + version[8] → SecretVersionTombstone
account_secret_index:           + account[20]                             → Vec<Bytes32>
account_release_key:            + account[20]                             → AccountReleaseKey
secret_release_key:             + account[20] + key_hash[32] + version[8] → SecretReleaseKey
cbss_release_key_evidence:      + recipient.encode()                      → sorted Vec<u64> epoch index
cbss_release_key_evidence:      + recipient.encode() + ':' + epoch[8]    → ReleaseKeyEvidenceEpoch

​

3.3 Master opcode allocation update

​

3.4 Cryptography

​

3.4.1 Vetted-library mandate

​

3.4.2 Curve choice: BLS12-381

1. Vetted threshold-encryption libraries exist on BLS12-381. Drand, Lit, the Ethereum-adjacent ecosystem, and Filecoin all ship BLS12-381 threshold tooling at production scale. On secp256k1 the equivalent threshold-encryption tooling does not exist in vetted form; a CBSS implementation on secp256k1 would require hand-rolling the DKG, partial decryption, and NIZK glue — exactly the cryptographic engineering anti-pattern this CIP rejects.
2. Pairing-friendly groups make threshold IBE possible with the simple Boneh-Franklin construction: encryption to an “identity” plus a threshold BLS signature on that identity is the IBE decryption key. No bespoke key-switching primitive required.
3. Production scale — Ethereum’s beacon chain, Filecoin proofs, Drand all use BLS12-381 at ≥ million-share scale, so library quality is high and corner cases are well-understood.

​

3.4.3 Construction: threshold IBE (“tlock” applied to secret release)

1. The n CBSS proxies in the committee run a threshold BLS DKG (the devnet implementation uses the pinned Commonware BLS DKG state machine; an equivalent vetted threshold-BLS DKG may be substituted by governance-reviewed implementation update). Round-2 share payloads are recipient-specific and HPKE-encrypted to each recipient’s on-chain CbssProxy.hpke_pubkey. If timeout or complaint handling excludes a dealer, the daemon finalizes over an explicit qualified dealer set of at least t members. Output: master public key MPK ∈ G2, Shamir shares s_1 … s_n ∈ Fr of the implicit master secret key MSK ∈ Fr. Threshold t. MSK is never reified.
2. MPK and the per-proxy commitments S_i = s_i · G2 ∈ G2 are published on chain in AccountReleaseKey or SecretReleaseKey.

3. Let wrap_epoch = the release key’s committee_epoch at SetSecret/FinalizeSecretVersion time, and mpk_g2 = compress(MPK) the 96-byte compressed master public key of that release key (AccountReleaseKey.mpk on the default path, SecretReleaseKey.mpk on the override path). Define the 172-byte base AAD: base_aad = u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 where canonical(SecretId) = account(20) || key_hash(32) (§3.5), so the fixed-width layout is chain_id(8) ‖ account(20) ‖ key_hash(32) ‖ version(8) ‖ wrap_epoch(8) ‖ mpk_g2(96) = 172 bytes. The leading chain_id is the chain separation binding: a secret wrapped for chain A is rejected by chain B’s validation and its released σ cannot unwrap it. The trailing mpk_g2 is the release-key binding: a secret wrapped under a substituted mpk' hashes to a different identity, so the real committee’s σ can never open it. Owner derives the per-version identity using this canonical encoding (§3.5 SubmitReleaseReceipt): I = hash_to_G1( base_aad, domain = "cbss/ibe/v1" ) (RFC 9380 hash-to-curve). I ∈ G1. The owner, the proxies, and the chain all compute I from these same inputs in the same byte encoding. I is derived from the 172-byte base_aad, not from the extended AEAD AAD below.
4. Owner samples a fresh encryption ephemeral scalar r ←$ Fr from a CSPRNG for every wrap, with r != 0, and computes U = r · G2_gen ∈ G2 (96-byte compressed). The owner MUST NOT reuse r across secret versions. Define the AEAD AAD: aad = base_aad || compress(U). Owner computes the IBE encryption key for I: K = HKDF-SHA256( serialize(e(I, MPK)^r), "cbss/ibe/v1" || aad ) where e(I, MPK)^r ∈ GT is equivalently e(I, r · MPK) or e(r · I, MPK), and serialize is the canonical compressed GT encoding (exactly 288 bytes; blstrs implements Compress for Gt). The notation HKDF-SHA256( ikm, info ) is normative throughout this CIP and means RFC 5869 HKDF with salt = the ASCII bytes "cbss/ibe/v1" (the same 11-byte domain string as the info prefix — not absent, not empty), info as written, and output length L = 32 bytes. The salt is load-bearing: a derivation with salt = None/empty produces a different K, so omitting it makes every wrap undecryptable cross-implementation.
5. Owner generates a fresh DEK (256 bits, CSPRNG). AES-256-GCM-encrypts the plaintext value with DEK + a fresh nonce + the 172-byte base_aad (the value envelope binds base_aad, not the U-extended aad — the value envelope’s key DEK is independent of U, so it binds only the chain- and release-key-bound base). Uploads the AES-GCM ciphertext to a private CBFS volume → cbfs_pointer. Because the stored value envelope binds base_aad, any change to chain_id, canonical(SecretId), version, wrap_epoch, or mpk_g2 invalidates the ciphertext of the secret value itself — not merely its DEK wrap. Reconstructing a value envelope with different bound fields requires the plaintext; changing only the DEK wrap is insufficient.
6. Owner AES-256-GCM-encrypts DEK with K + a separate nonce and the 268-byte extended aad from step 4 (base_aad || compress(U)), producing wrapped_dek. Only the DEK wrap binds the extended AAD; the chain re-derives and full-equality-checks all 268 bytes at SetSecret/FinalizeSecretVersion (§3.5).
7. Owner publishes wrapped_dek + cbfs_pointer + wrap_epoch + recipient + policy on chain via SetSecret (default path) or FinalizeSecretVersion (override path; see §3.5). wrapped_dek includes ephemeral_u = compress(U).

8. Runner signs the ReleaseRequestBody directly with its runner-registry key (the secp256k1 key registered with 0x01 Runner Registry, the same key it uses for any other authenticated runner→chain interaction). No runner-binding ephemeral keypair is involved — the IBE construction does not require a runner-bound ciphertext, so there is no per-request runner ephemeral. This is distinct from the owner-chosen Boneh-Franklin encryption ephemeral r in step 4. Both proxies (at PartialSign serve time) and the chain (at SubmitReleaseReceipt validation) verify runner_sig against the runner registry.
9. Runner reads the SecretVersion (carrying wrap_epoch) and the referenced ReleaseKey (carrying current committee + S_is) from chain. Runner sends a release request to t proxies. Each proxy validates ACL/manifest/job-assignment/anti-replay (§3.7).
10. Each proxy computes the identity exactly as the owner did, using the SecretVersion’s wrap_epoch and the canonical encoding from step 3: I = hash_to_G1( u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2, domain = "cbss/ibe/v1" ), then its partial signature: σ_i = s_i · I ∈ G1 (using the proxy’s current share s_i — PSS guarantees this works regardless of the relationship between wrap_epoch and the proxy’s current share epoch).
11. Each proxy returns σ_i to the runner. Verification is the standard BLS partial-signature check: validate e(σ_i, G2_gen) == e(I, S_i) where S_i ∈ G2 is the proxy’s published VSS commitment. Implementations MUST reject identity/point-at-infinity S_i and σ_i before the pairing check; otherwise e(0, G2_gen) == e(I, 0) passes vacuously. No bespoke NIZK required — the BLS pairing equation is its own proof of correctness.
12. Runner combines t partial signatures via Lagrange interpolation in G1: σ = Σ λ_i · σ_i = MSK · I ∈ G1 (the full threshold BLS signature on I, equivalently the IBE decryption key for I).
13. Runner reads wrapped_dek.ephemeral_u (decoding it to U; §3.1 notation), reconstructs the same extended aad = base_aad || ephemeral_u, and derives K = HKDF-SHA256( serialize(e(σ, U)), "cbss/ibe/v1" || aad ). By bilinearity, e(σ, U) = e(MSK · I, r · G2_gen) = e(I, G2_gen)^(MSK · r) = e(I, MPK)^r — the same K the owner computed at step 4.
14. Runner AES-256-GCM-decrypts wrapped_dek with K → DEK.
15. Runner fetches the CBFS object via cbfs_pointer, AES-256-GCM-decrypts ciphertext with DEK + the 172-byte base_aad (the value envelope’s AAD; §3.1) → plaintext.

​

3.4.4 Security properties

• t-of-n threshold: any t honest proxies can complete a release; t-1 cannot reconstruct σ and therefore cannot derive K. Given public (I, MPK, U), deriving K without σ requires computing e(I, MPK)^r = e(I, G2_gen)^(MSK · r) from (G2_gen, MPK = MSK · G2_gen, U = r · G2_gen), reducing to the co-BDH assumption on BLS12-381.
• Owner-chosen U: a malformed owner-chosen r/U weakens or bricks only that owner’s own secret. Binding compress(U) into the AAD makes post-publish tampering a hard AEAD failure rather than a silent mis-derivation.
• No new steering surface: r is supplied by the secret owner for that owner’s own secret. Proxies and runners treat U as opaque KEM material; reshare/PSS properties are unchanged because the committee still releases σ for the same identity I.
• Per-(secret_id, version, wrap_epoch) σ: a leaked σ decrypts only the wrapped DEK for that exact identity. Compromising a different secret version requires a separate t-of-n collusion to derive its σ. Reshare does NOT invalidate σ values for prior identities; PSS preserves MSK and hence preserves σ for any identity I.
• No bespoke NIZK: BLS partial-signature verification is a single pairing check, covered by blstrs and the vetted threshold-BLS implementation.
• Anti-replay, ACL, audit: enforced at the proxy validation layer (§3.7) and via per-proxy receipts (§3.5). Cryptographic envelope intentionally does NOT bind to a runner ephemeral key — see §3.4.5 for why.
• Reshare: proactive secret sharing on MSK rotates shares without changing MPK. Stored secrets remain decryptable. In-flight release requests are NOT invalidated by reshare; a proxy’s freshly-resharded share still produces valid partials for any prior-epoch identity.
• Insider rotation: the value of reshare is bounding the window during which a specific share-holder’s compromised share is useful. After reshare, that specific s_i is replaced; the attacker must re-compromise the new s_i’ to keep contributing to t-of-n.

​

3.4.5 Why threshold IBE, not threshold ElGamal with key-switching

1. No vetted Rust library exists. Threshold ElGamal on secp256k1 requires hand-rolling the DKG, partial-decrypt construction, and Chaum-Pedersen NIZK. Standard cryptographic-engineering hygiene says: don’t roll your own crypto when a vetted equivalent exists. BLS12-381 + threshold IBE has vetted equivalents (Commonware BLS DKG, tlock, blstrs); secp256k1 + threshold ElGamal does not.
2. Key-switching to runner ephemeral pubkey was solving a problem we don’t actually have. The runner is the legitimate recipient of DEK; cryptographically binding the ciphertext to a runner-ephemeral pubkey adds protocol complexity without buying additional security beyond what proxy-side anti-replay/ACL already provide. Threshold IBE produces DEK directly to the runner; the runner zeroizes after use; revocation/replay/audit happen at validation time, not in the envelope.

​

3.4.6 Time-Lock Release mode (height-gated, public identity)

I_tlock = hash_to_G1( canonical(tag) || u64_le(target_height), domain = "cbss/tlock/v1" )   ∈ G1

Scope boundary (normative): time-lock release does NOT inherit the §3.4.3 account-secret AAD. “Identical to §3.4.3” above scopes to the pairing/HKDF construction, not to the AAD contents. Time-lock release keeps its own base AAD — base_aad_tlock = tag ‖ u64_le(target_height) (for CIP-34 sealed bids, tag = request_id, so base_aad_tlock = request_id(32) ‖ u64_le(reveal_height); CIP-34 §Sealed-Bid), extended to aad = base_aad_tlock ‖ compress(U) for the AEAD. It does not gain chain_id and does not gain mpk_g2; the §3.4.3 chain-separation and release-key bindings apply only to the account-secret family. Base AADs in this CIP are per-family and do not inherit across families (the same rule that keeps CIP-9’s volume path on its own base AAD, §9.3). The tlock/CIP-34 key-substitution exposure is therefore not closed by an AAD change (a submit-time mismatch would arrive too late, and there is no on-chain envelope validation to attach it to); it is addressed by authenticating the committee MPK at the encryptor against the release key’s release_key_material_hash before sealing, and by an independent committee-side reveal-height check — both tracked as separate workstreams, not as changes to this base AAD. See CIP-34 for the sealed-bid scoping statement.

σ_i = s_i · I_tlock   ∈ G1          (SubmitTlockRelease, §3.5)

​

3.5 New system instructions

​

SetSecret (opcode 68)

SetSecret {
    key_hash:             Bytes32                        // == keccak256(sender || key_name); plaintext key_name never crosses the wire
    recipient:            ReleaseKeyRef                  // Account(sender) for default; SecretSpecific(SecretId, next_version) for override
    policy:               SecretPolicy
    // Default path (recipient = Account(_)) carries ciphertext immediately:
    cbfs_pointer:         Option<CbfsPointer>            // Some on default path; None on override path. CIP-9 envelope; carries the outer plaintext-encryption nonce internally.
    wrap_epoch:           Option<u64>                    // Some on default path (== AccountReleaseKey.committee_epoch); None on override path
    wrapped_dek:          Option<WrappedDek>             // Some on default path (carries inner DEK-wrap nonce + ephemeral_u + aad); None on override path
    // Override path carries committee parameters:
    committee_override:   Option<CommitteeOverride>      // Some on override path; None on default path
}

struct CommitteeOverride {
    n:                 u8                     // 5 ≤ n ≤ MAX_OVERRIDE_N
    t:                 u8                     // MIN_OVERRIDE_T ≤ t ≤ n
    preferred_proxies: Option<Vec<ProxyId>>   // hints; final committee is VRF-selected from this set if Some
}

struct WrappedDek {
    version:      u8                 // format-version tag == 2 (WRAPPED_DEK_FORMAT_VERSION); leading byte/field of every serialization (§3.1)
    ciphertext:   Bytes              // AES-256-GCM ciphertext of the DEK
    nonce:        [u8; 12]
    ephemeral_u:  [u8; 96]           // = compress(U), U = r · G2_gen ∈ G2; canonical compressed BLS12-381 G2 encoding
    aad:          Bytes              // == u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 || ephemeral_u
}

• Default path (recipient = Account(sender)): must carry cbfs_pointer + wrap_epoch + wrapped_dek (DEK encrypted under the IBE key derived from the account’s existing MPK; nonces, ephemeral_u, and AAD are inside WrappedDek and the CIP-9 CBFS envelope). The instruction is rejected with MissingAccountReleaseKey if the sender has no AccountReleaseKey on file (the cowboy CLI auto-issues RequestAccountDkg on first use). Allocates version = max(SecretMetadata.latest_version, secret_version_hwm) + 1 (checked u64 add; fails closed only when that floor is already u64::MAX), creates SecretVersion(version) under SecretId(sender, key) with pending = false, and advances the durable high-water mark to that version — see “Secret version allocation and non-reuse” in §3.2. Emits SecretCreated.
• Override path (recipient = SecretSpecific(SecretId, next_version)): must NOT carry cbfs_pointer / wrap_epoch / wrapped_dek. Instead carries committee_override. Effects:
  1. Creates SecretVersion(version = next_version) with pending = true, wrap_epoch = None, cbfs_pointer = None, wrapped_dek = None, where next_version MUST equal the chain’s allocation max(SecretMetadata.latest_version, secret_version_hwm) + 1 (the instruction is rejected otherwise; see “Secret version allocation and non-reuse” in §3.2). Advances the durable high-water mark to next_version. (The §3.1 invariant requires all three Option fields are None on a pending version.) wrap_epoch is populated by FinalizeSecretVersion once MPK exists.
  2. Locks DKG_BOND from the sender, VRF-selects an n-proxy committee per the override spec, and writes a DkgPending(SecretSpecific(SecretId, next_version), committee, deadline, bond_amount, requester = sender) record.
  3. Off-chain DKG runs (§3.6.1). On commit, the committee submits RotateCommittee { scope: SecretSpecific(...), new_committee_epoch: 1, ... }, which writes the new SecretReleaseKey and exposes MPK on chain.
  4. Owner reads MPK + committee_epoch from chain, sets wrap_epoch = committee_epoch (= 1 here), samples fresh r != 0, computes U = r · G2_gen, derives K = HKDF(serialize(e(I, MPK)^r), "cbss/ibe/v1" || aad) with aad = u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 || compress(U), encrypts DEK to K, uploads CBFS ciphertext, and submits FinalizeSecretVersion (opcode 78) to attach cbfs_pointer + wrapped_dek + wrap_epoch and clear pending.
  5. Until step 4 lands, release attempts against this version fail closed with SecretPending.

• Default path: wrapped_dek.version == 2 (§3.1; rejects with UnsupportedWrappedDekVersion otherwise); wrap_epoch == account_release_key.committee_epoch at SetSecret block; wrapped_dek.ephemeral_u is the canonical compressed encoding of a non-identity G2 point in the prime-order subgroup (subgroup membership REQUIRED; §3.4.3); and wrapped_dek.aad == u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 || wrapped_dek.ephemeral_u, where chain_id is this chain’s identifier and mpk_g2 = compress(account_release_key.mpk) — both taken from committed state loaded one step above (the AccountReleaseKey already in hand for the wrap_epoch check), never from the envelope. Rejects with WrapEpochMismatch / AadMismatch otherwise. A wrapped_dek sealed under a substituted mpk' (or for another chain) therefore fails this full-equality check with AadMismatch — the chain-side half of the release-key binding (§3.4.3).
• Override path: committee_override.n and t within (MIN_OVERRIDE_T, MAX_OVERRIDE_N); preferred_proxies (if Some) all eligible.
• Both paths: key_hash is a well-formed 32-byte value; quotas not exceeded. (Plaintext KeyName regex enforcement is CLI/SDK-side, since the chain never sees plaintext.)

​

FinalizeSecretVersion (opcode 78)

FinalizeSecretVersion {
    key_hash:      Bytes32
    version:       u64
    wrap_epoch:    u64                  // == secret_release_key.committee_epoch at this submission's block
    cbfs_pointer:  CbfsPointer          // CIP-9 envelope; carries outer plaintext-encryption nonce internally
    wrapped_dek:   WrappedDek           // carries inner DEK-wrap nonce + ephemeral_u + aad
}

• SecretVersion exists, has pending = true, and recipient = SecretSpecific(_, version).
• The corresponding SecretReleaseKey is committed (exists on chain) and its committee_epoch ≥ 1.
• wrap_epoch == secret_release_key.committee_epoch at FinalizeSecretVersion block (no resharing in between, OR the owner explicitly accepts re-wrapping under the new epoch).
• wrapped_dek.version == 2 (§3.1); rejects with UnsupportedWrappedDekVersion otherwise.
• wrapped_dek.ephemeral_u is the canonical compressed encoding of a non-identity G2 point in the prime-order subgroup (subgroup membership REQUIRED; §3.4.3).
• wrapped_dek.aad == u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 || wrapped_dek.ephemeral_u, with chain_id this chain’s identifier and mpk_g2 = compress(secret_release_key.mpk) derived from committed state (the override path’s SecretReleaseKey), never from the envelope; a substituted mpk' or wrong-chain wrap fails with AadMismatch.

​

UpdateSecretPolicy (opcode 69)

UpdateSecretPolicy {
    key_hash:    Bytes32
    version:     u64
    new_policy:  SecretPolicy
}

​

DeleteSecretVersion (opcode 70)

DeleteSecretVersion { key_hash: Bytes32, version: u64 }

​

DeleteSecret (opcode 71)

DeleteSecret { key_hash: Bytes32 }

​

RegisterCbssProxy (opcode 72)

RegisterCbssProxy {
    pubkey:        PublicKey
    hpke_pubkey:   HpkePublicKey
    tls_spki:      Bytes                  // DER SubjectPublicKeyInfo pin for QUIC TLS verification
    network_addr:  NodeAddr
    stake_amount:  U256                  // ≥ MIN_PROXY_STAKE; locked from operator's account
}

​

DeregisterCbssProxy (opcode 73)

DeregisterCbssProxy { proxy_id: ProxyId }

​

RotateCommittee (opcode 74)

RotateCommittee {
    scope:               ReleaseKeyScope
    new_committee:       Vec<ProxyId>          // exactly `n` distinct, all eligible
    new_committee_epoch: u64                   // == old + 1; for fresh DKG (initial), == 1
    new_mpk:             G2Point               // 96 B compressed; on initial DKG this is the freshly-generated MPK; on reshare this MUST equal the prior MPK (chain enforces; PSS preserves MSK so MPK is preserved)
    vss_commitments:     Vec<G2Point>          // n entries, S_i = s_i · G2 ∈ G2 (matches §3.4 verification e(σ_i, G2_gen) == e(I, S_i))
    new_committee_sigs:  Vec<Signature>        // ≥ t signatures FROM new_committee MEMBERS attesting to the DKG output. REQUIRED on both initial DKG and reshare. Each sig is over the unified `rotate_hash` (domain "cbss/rotate-committee/v1"; full big-endian preimage in §"Canonical domain-separated signature payloads") under the proxy's registered identity key.
    prior_committee_sigs: Vec<Signature>       // ≥ t signatures from PRIOR committee attesting they zeroized old shares. REQUIRED on reshare; OMITTED on initial DKG (no prior committee exists). Each sig is over the SAME `rotate_hash` as new_committee_sigs (domain "cbss/rotate-committee/v1", not a separate preimage) under the prior proxy's identity key.
}

enum ReleaseKeyScope {
    Account(Address),
    SecretSpecific(SecretId, u64),
}

​

SlashCbssProxy (opcode 75)

SlashCbssProxy {
    proxy_id:    ProxyId
    fault_class: FaultClass
    evidence:    SlashEvidence
}

enum FaultClass {
    InvalidPartialReencrypt,             // invalid blinded partial or authenticated out-of-range serve stamp
    DkgSabotage,                         // VSS commitment / share mismatch in DKG round 2
    Equivocation,                        // Two distinct signed responses (same request_hash, distinct payloads)
}

​

SubmitLivenessChallenge (opcode 79)

SubmitLivenessChallenge {
    runner_request:             SignedReleaseRequestV4 // the original signed request the runner claims went unanswered
    proxy_id:                   ProxyId               // proxy alleged non-responsive
    challenge_sig:              Signature             // exact byte layout: see "Canonical domain-separated signature payloads"
                                                      // following the request hash definitions earlier in §3.5.
                                                      // Signed by the runner named in the request with the "cbss/liveness-challenge/v4" domain prefix.
                                                      // (No challenged_at in the signed payload — chain assigns it on inclusion.)
}

1. The request’s chain_id matches this chain. The V4 request signature and outer challenge_sig each recover the runner address named in the request.
2. request_block + MIN_CHALLENGE_DELAY_BLOCKS ≤ submission_block ≤ request_block + LIVENESS_CHALLENGE_MAX_AGE_BLOCKS, with saturating height addition. The handler sets challenged_at = submission_block.
3. An accepted release_receipt:{release_id} set exists for the exact request hash and serve epoch, with a nonzero threshold and at least that many receipts and eligible committee members. The challenged proxy belongs to that stored committee snapshot. Every receipt matches the request hash and epoch, and its proxy index matches its committee position; indices are strictly increasing and proxy IDs are unique. This authenticated attempt proof remains valid across later reshares; admission does not re-evaluate current ACL, manifest, job assignment or SecretVersion state.
4. Per-release liveness dedup. No liveness_challenge_index:{release_id}:{proxy_id} entry exists. While the index exists, another challenge for that pair is rejected. A response to a pending challenge and expiry of a pending challenge delete the index; the retained challenge record alone is not a permanent dedup guard. A challenge resolved at admission keeps its index.
5. If the accepted receipt set already contains a receipt from the challenged proxy, the challenge is immediately Resolved and the runner forfeits the bond to that proxy.

​

LivenessChallengeResponse (opcode 80)

LivenessChallengeResponse {
    challenge_id:  Bytes32
    proxy_id:      ProxyId
    reason:        ChallengeReason
    evidence:      ChallengeResponseEvidence
    proxy_sig:     Signature                         // see "Signed payload" below
}

enum ChallengeReason {
    // NOT chain-verifiable (logged for governance pattern detection):
    InvalidRequest,           // proxy claims the request failed validation at serve time (ACL, manifest, job assignment, sig). NOT auto-resolving because chain re-derivation at response time would use later state and the admission-time snapshot is not stored. Logged with the proxy's structured reason for governance pattern detection.
    RateLimited,              // proxy claims its local rate-limiter rejected the request. Per-actor rate limits are proxy-local sliding-window state and the chain has no way to verify the proxy's claim.
    NeverReceived,            // proxy claims the network request did not arrive; not provable on chain.
}

// Domain-separated signed payload. Implementations MUST sign exactly these bytes:
proxy_sig := sign(proxy_priv,
              keccak256( "cbss/liveness-response/v1" ||
                         challenge_id ||
                         proxy_id ||
                         u8(reason) ||
                         keccak256(serialize(evidence)) ))

• Resolved — not produced by LivenessChallengeResponse; produced only by the admission-time receipt check in SubmitLivenessChallenge. Chain dereferences release_receipt:{release_id} and confirms the entry exists with proxy_id matching. Health-score impact on the proxy: small positive (proved liveness via receipt). Bond disposition: forfeited to the challenged proxy.
• Unverifiable — proxy submits LivenessChallengeResponse with InvalidRequest / RateLimited / NeverReceived before deadline. Chain cannot re-derive any of these. Bond → refunded to the runner (the runner submitted a good-faith challenge; whether the proxy’s response is honest is unknowable on-chain). Health-score impact on the proxy: NEUTRAL — no automatic decrement. Pattern detection lives in off-chain governance.
• Unanswered — proxy submits no response by deadline. The runner was right — the proxy is genuinely silent. Bond → refunded to the runner. Health-score impact on the proxy: standard negative decrement. Persistent unanswered patterns flag the proxy for governance review per §4.4.

​

SubmitReleaseReceipt (opcode 76)

SubmitReleaseReceiptArgsV4 {
    runner_request: SignedReleaseRequestV4
    response:       PartialSignResponseV4
}

SignedReleaseRequestV4 {
    body:             ReleaseRequestBodyV4
    runner_signature: EthSignature
}

ReleaseRequestBodyV4 {
    context:          ReleaseRequestContextV4
    blinded_identity: G1Bytes
    proof:            BlindingAuthorizationProofV1  // r: G1Bytes, z: [u8; 32]
}

ReleaseRequestContextV4 {
    chain_id:      u64
    secret_id:     SecretId
    version:       u64
    actor:         Address
    runner_id:     Address
    recipient:     ReleaseKeyRef
    job_id:        JobId
    release_nonce: Bytes32
    request_block: BlockHeight
    serve_epoch:   u64
    cip33:         Option<Cip33ReleaseContext>
}

PartialSignResponseV4 {
    request_hash:             Bytes32
    proxy_id:                 ProxyId
    proxy_index:              u32       // one-based position in the ordered committee
    committee_epoch_at_serve: u64
    served_at_block:          BlockHeight
    tau:                      G1Bytes   // blinded partial, 48-byte compressed G1
    proxy_signature:          EthSignature
}

body_v4      := codec(ReleaseRequestBodyV4)
request_hash := keccak256("cbss/release-request/v4" || u32_be(len(body_v4)) || body_v4)

release_id   := keccak256("cbss-release-id/v4" || u64_be(context.chain_id) ||
                         canonical(context.secret_id) || u64_le(context.version) ||
                         context.actor || context.runner_id || context.job_id ||
                         context.release_nonce || u64_le(context.serve_epoch))

canonical(SecretId) := secret_id.account || secret_id.key_hash  // 20 + 32 bytes

runner_signature (in SignedReleaseRequestV4):
    sign(runner_priv, request_hash)

proxy_signature (in PartialSignResponseV4):
    response_core := codec(PartialSignResponseV4 without proxy_signature)
                     // 133 bytes, including the leading V4 tag and proxy_index
    sign(proxy_identity_priv,
         keccak256("cbss/blinded-partial-response/v4" || response_core))

challenge_sig (in SubmitLivenessChallenge):
    body_v4 := codec(ReleaseRequestBodyV4)
    request_hash_v4 := keccak256("cbss/release-request/v4" || u32_be(len(body_v4)) || body_v4)
    sign(runner_priv,
         keccak256("cbss/liveness-challenge/v4" ||
                   request_hash_v4 ||
                   proxy_id))

response proxy_sig (in LivenessChallengeResponse):
    sign(proxy_identity_priv,
         keccak256("cbss/liveness-response/v1" ||
                   challenge_id ||
                   proxy_id ||
                   u8(reason) ||
                   keccak256(serialize(evidence))))

new_committee_sig / prior_committee_sig (in RotateCommittee):
    BOTH the new committee AND the prior committee sign the SAME rotate_hash,
    domain-separated under the single tag "cbss/rotate-committee/v1"
    (node/execution/src/cbss.rs::rotate_committee_hash). Exact preimage
    (all integers big-endian, no length prefix on the domain):
    rotate_hash = keccak256(
        "cbss/rotate-committee/v1" ||
        scope.encode() ||
        u8(force_rekey) ||
        u32(new_committee.len()) || new_committee[i] (each 32-byte proxy_id, in order) ||
        u64(new_committee_epoch) ||
        new_mpk (96-byte G2) ||
        u32(vss_commitments.len()) || vss_commitments[i] (each 96-byte G2, in order))

1. Authenticate runner_request.runner_signature against the runner address in the V4 context; recompute request_hash and release_id as above.
2. Check the existing (release_id, response.proxy_id) receipt. An exact replay of an accepted receipt returns success, including after freshness expires; a conflicting receipt is rejected.
3. For a new receipt, require request_block ≤ submission_block ≤ request_block + REQUEST_FRESHNESS_BLOCKS, using saturating addition, and request_block ≤ served_at_block ≤ submission_block. The response hash must match the request, and committee_epoch_at_serve must equal the runner’s serve_epoch.
4. Evaluate current release authorization, including the version, policy, manifest and job/session authority. Authenticate the proxy response and resolve the serving epoch’s release key and committee. A retained prior epoch is usable only through its inclusive expires_at boundary (§3.5).
5. Require the response’s nonzero proxy_index to equal the proxy’s one-based position in the resolved committee. Verify the runner’s blinding authorization against the committed wrap_epoch and MPK, derive S_i from the VSS polynomial at that index, and check the blinded partial’s pairing. Malformed points and failed proofs are rejected.
6. Require every receipt in the set to share the same request hash, epoch, threshold and ordered eligible committee snapshot. A new receipt is rejected once the threshold has already been reached.
7. TEE eligibility is chain-derived. The release evaluator checks the required TEE authority in the logical TEE Verifier’s records, physically stored at 0x04 (§3.2). It checks a runner’s measurement binding and, where the signed-attestation path applies, tee_attestation: + job_id || runner_id. The proxy cannot supply a tee_attested override.

event ReleaseReceiptRecorded {
    release_id:    Bytes32             // stable across t receipts for the same logical release
    request_hash:  Bytes32             // identifies the specific signed request this receipt fulfilled
    account:       Address
    actor:         ActorAddress
    runner:        RunnerAddress
    key_hash:      Bytes32             // == secret_id.key_hash; same caveat as §3.2 (dictionary-guessable)
    version:       u64
    proxy_id:      ProxyId             // single proxy per event
    tee_attested:  bool                 // chain-derived from TEE Verifier state at submission
    block:         BlockHeight
}

event SecretReleased {
    release_id:    Bytes32
    account:       Address
    actor:         ActorAddress
    runner:        RunnerAddress
    key_hash:      Bytes32
    version:       u64
    tee_attested:  bool                 // chain-derived; aggregates true iff every contributing receipt observed valid TEE attestation
    proxy_set:     Vec<ProxyId>         // exactly the t proxies whose receipts crossed the quorum threshold
    block:         BlockHeight
}

​

RequestAccountDkg (opcode 77)

RequestAccountDkg {}                           // sender = the account itself

​

GovRequestSystemDkg (opcode 158, provisional)

GovRequestSystemDkg {
    scope: ReleaseKeyScope    // the release-key scope to bootstrap, e.g. Account(0x14)
    force_rekey: bool         // false = first-time bootstrap; true = re-DKG an existing key
}

​

ExpireDkgPending (opcode 81)

ExpireDkgPending {
    scope: ReleaseKeyScope    // identifies the DkgPending entry to expire
}

1. dkg_pending:{scope_serialized} exists.
2. current_block >= DkgPending.deadline, or the sender is the requester cancelling before the deadline.
3. No RotateCommittee for this scope has landed (i.e., the DKG didn’t complete in some other path).

​

ExpireLivenessChallenge (opcode 82)

ExpireLivenessChallenge { challenge_id: Bytes32 }

1. Charge CBSS_GAS_EXPIRE_LIVENESS_CHALLENGE = 5_000.
2. Load the challenge; require status == Pending AND current_block > challenge.deadline, else InvalidData.
3. Transition status → Unanswered and clear the response fields.
4. proxy.health.unanswered_challenges += 1; apply the capped liveness-attrition penalty (COW-1058: CBSS_LIVENESS_HEALTH_PENALTY_BPS = 100 per unanswered, bounded by CBSS_MAX_HEALTH_LOSS_PER_EPOCH_BPS = 1000) to health.score_bps.
5. If the penalty crosses below MIN_HEALTH_FLOOR_BPS (or sustained sub-threshold ≥ GOVERNANCE_REVIEW_BLOCKS), write a ProxyGovernanceReviewFlag and emit cbss.proxy.governance_review_required.
6. Refund the challenge bond to runner_request.body.runner_id.
7. Delete the liveness dedup-index entry; emit cbss.liveness.expired { challenge_id }.

​

RequestReshare (opcode 83)

RequestReshare { scope: ReleaseKeyScope }

1. Charge CBSS_GAS_REQUEST_RESHARE = 30_000; ensure_cbss_actor_exists.
2. Load the release-key material for scope; InvalidData if absent.
3. Require tx.from == material.owner, else Unauthorized.
4. Push a reshare_requested event into the CBSS actor event log (which cbssd polls — COW-2338: this is the third reshare trigger alongside the churn and deregister paths). No bond is locked and the committee state is not mutated on-chain; the event signals cbssd to orchestrate the off-chain reshare, which lands via a subsequent RotateCommittee.

​

ForcedDeregisterCbssProxy (opcode 84)

ForcedDeregisterCbssProxy { proxy_id: ProxyId }

1. Charge CBSS_GAS_DEREGISTER_PROXY = 8_000.
2. Require tx.from == GOVERNANCE_SYSTEM_ACTOR, else Unauthorized.
3. Load the proxy (InvalidData if absent); set proxy.suspended = true and proxy.unbond_at = Some(current_block) — immediate unbond, no delay (contrast the voluntary DeregisterCbssProxy path, which still respects the cooldown). If the proxy sits on any live committee, RotateCommittee is enqueued for each affected release key (as in voluntary deregister).
4. Emit cbss.proxy.forced_deregistered { proxy_id }.

​

RegisterTlockRelease (opcode 152, provisional)

RegisterTlockRelease {
    scope:          ReleaseKeyRef    // which committee's MPK this tlock binds to (Account or SecretSpecific)
    tag:            Bytes            // caller identity, ≤ MAX_TLOCK_TAG_BYTES (e.g. a CIP-34 request_id)
    target_height:  u64              // reveal height; MUST be > head + MIN_TLOCK_LEAD_BLOCKS
}

​

SubmitTlockRelease (opcode 153, provisional)

SubmitTlockRelease {
    scope:          ReleaseKeyRef
    tag:            Bytes
    target_height:  u64
    proxy_id:       ProxyId
    partial:        [u8; 48]         // σ_i = s_i · I_tlock ∈ G1, canonical compressed
}

​

3.6 Threshold ceremonies

​

3.6.1 DKG (initial keypair establishment)

1. Round 1. Each proxy i samples a random degree-t-1 polynomial f_i(x) over the BLS12-381 scalar field and broadcasts Feldman/Pedersen commitments to its coefficients (peer-to-peer over the committee mesh; no on-chain anchor).
2. Round 2. Each proxy i sends f_i(j) to each peer j, encrypted under j’s registry pubkey. Recipients verify the share against the broadcast commitments using a single G2 multi-scalar multiplication.
3. Aggregation. Each proxy computes its share s_i = Σ_j f_j(i) (a scalar), summing only the qualified dealers when timeout/complaint handling excluded a dealer. The group MPK = Σ_j C_{j,0} ∈ G2 (sum of each qualified polynomial’s constant-term commitment in G2). Each proxy’s published VSS commitment S_i = s_i · G2 is computable from the aggregated polynomial commitments at index i.
4. On-chain commit. Once each proxy has its share s_i and the group MPK, the committee assembles new_committee_sigs — t-of-n signatures over the canonical DKG-commit payload (see RotateCommittee). One proxy posts RotateCommittee(scope, new_committee_epoch = 1, new_mpk, vss_commitments = [S_1..S_n], new_committee_sigs). The chain verifies: (a) each S_i is a valid G2 point, (b) new_committee_sigs.len() >= threshold and all sigs are from members of new_committee over the canonical payload, (c) on a reshare, new_mpk == prior_release_key.mpk. The chain does NOT verify Shamir consistency on chain — that’s the committee’s responsibility off-chain via VSS during DKG, attested to by the threshold signatures. (A naive “sum(S_i) == MPK” check would be mathematically wrong since S_i are polynomial evaluations, not coefficient commitments.)

​

3.6.2 Reshare (proactive secret sharing)

• Scheduled rotation: every RESHARE_INTERVAL_BLOCKS (default ~6 months) for both AccountReleaseKey and SecretReleaseKey records.
• Committee churn: when the count of healthy committee members drops to t + RESHARE_SAFETY_MARGIN.
• Owner request: the owner of the account (or of the secret in the override case) pays for an immediate reshare.

​

3.6.3 Threshold partial signature (release)

• The runner’s release request (signed; carries recipient, job_id, request_block, serve_epoch, and request-binding fields). serve_epoch pins which share-polynomial epoch the runner expects partials from; proxies reject with EpochMismatch if their current release-key committee_epoch differs. The IBE identity still comes from the SecretVersion’s immutable wrap_epoch, not from serve_epoch.
• The proxy’s local Shamir share s_i ∈ scalar field of BLS12-381 of the implicit MSK.

1. Validates the request (§3.7), looking up the relevant AccountReleaseKey or SecretReleaseKey per the request’s recipient field and checking body.serve_epoch == release_key.committee_epoch at current head.
2. Reads wrap_epoch from the SecretVersion on chain and mpk_g2 = compress(MPK) from the release key looked up in step 1. Computes the identity using the canonical encoding: I = hash_to_G1( u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2, domain = "cbss/ibe/v1" ).
3. Computes its partial BLS signature on the identity: σ_i = s_i · I (a point in G1).
4. Returns the canonical PartialSignResponse wire shape:
   PartialSignResponse {
       sigma_i:                 G1Bytes
       proxy_id:                ProxyId
       committee_epoch_at_serve: u64                   // current release_key.committee_epoch at the time of partial-sign
       served_at_block:         BlockHeight
       proxy_sig:               Signature              // exact byte layout: see "Canonical domain-separated signature payloads" earlier in §3.5; signed under the proxy identity key with the "cbss/partial-sign-response/v1" domain prefix. SAME bytes as the receipt's proxy_sig — proxy can hand the response into the receipt verbatim.
   }
   
   The proxy does NOT include its own VSS commitment in the response — the chain looks up S_i from the release key’s vss_commitments (current or retained-prior epoch) keyed by proxy_id + committee_epoch_at_serve. This prevents a malicious proxy from substituting a different commitment.

​

3.7 Proxy-side validation of release requests

​

3.8 Runner pull flow

1. Actor task invokes runner.http(..., secrets=["SLACK_API_KEY"]).
2. Runner R looks up the secret-owning account (the actor's owning account by default,
   or the explicit cross-account owner if the entitlement uses {account, key} form).
   The runner-side SDK computes key_hash = keccak256(account || "SLACK_API_KEY") locally;
   plaintext key never leaves the runner sandbox.
3. Runner R syscalls SYS_FETCH_SECRET_METADATA(secret_id = SecretId{account, key_hash},
   version_or_latest) → SecretMetadata + the referenced ReleaseKey snapshot
   (Account or SecretSpecific). The syscall takes SecretId, not plaintext.
4. Runner R picks t of n committee proxies (prefers non-suspended, healthier, low-latency proxies; fall-through to remaining n-t on failure).
5. Runner R generates a fresh release_nonce (CSPRNG, 32 B), reads the release key's
   current committee_epoch as serve_epoch, assembles ReleaseRequestBody
   with request_block = current chain head and serve_epoch = committee_epoch,
   signs it with its runner-registry key
   (NOT an ephemeral key — see §3.4.5 / §3.5 for the registry-key requirement).
   Sends SignedReleaseRequest = { body, runner_sig } to t of n committee proxies in parallel
   (preferring non-suspended, healthier, low-latency proxies; fall-through to remaining n-t on failure).
6. Each proxy validates (§3.7), decrypts its local sealed share with AAD bound to `(release-key scope, committee_epoch)`, verifies the scalar against the VSS commitment polynomial, and returns its BLS partial signature σ_i on the identity
   (PartialSignResponse with sigma_i, committee_epoch_at_serve, served_at_block, proxy_sig).
7. Runner R verifies each σ_i with a single pairing check against the proxy's VSS commitment
   (looked up on chain by proxy_id + committee_epoch_at_serve);
   rejects duplicate proxy indexes, and Lagrange-combines σ_i to produce σ = MSK · I.
8. Runner R reads `wrapped_dek.ephemeral_u` (decoding it to `U`), reconstructs `aad = u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 || ephemeral_u`, derives K = HKDF(serialize(e(σ, U)), "cbss/ibe/v1" || aad), and AES-GCM-decrypts wrapped_dek → DEK.
9. Runner R fetches CBFS object, AES-GCM-decrypts with DEK + AAD verification → plaintext.
10. Runner R passes plaintext to the in-memory ${SLACK_API_KEY} substitutor at request-construction
    in runner-http / runner-mcp. NO process-wide env var injection on the default path
    (see §3.9).
11. Runner R executes the templated request.
12. Runner R zeroizes plaintext, DEK, σ partials.
13. Each of the t participating proxies independently submits SubmitReleaseReceipt
    (handing the SignedReleaseRequest verbatim into the receipt). Runner does NOT submit
    any audit/payment tx; payment flows directly proxy ← actor account, capped at quorum t.

​

3.9 Runtime sandbox: in-memory secret bundle (default), env vars only for spawned subprocesses

• Holds plaintext in a Zeroizing<Vec<u8>> SecretBundle keyed by KeyName.
• Performs ${KEY} substitution at request-construction time inside runner-http / runner-mcp (against headers, URL, body, JSON tool args) — the substitution layer reads the bundle directly without touching the process environment.
• Drops the bundle (zeroizes) at the end of the runner-op.
• Never sets os.environ[KEY] for HTTP / MCP / LLM tool calls.

• Build an explicit env: HashMap<String, Zeroizing<String>> for the child.
• Pass via Command::env_clear().envs(env) — the child inherits ONLY the named entries, not the parent’s environment.
• The parent’s process environment is never mutated.
• Drop the Command builder immediately after spawn and zeroize the source env map.
• Residual exposure: Rust’s std::process::Command copies env values into its own platform-specific storage before spawning, and the standard library does not guarantee that copy is zeroized. Treat subprocess env delivery as an explicit compatibility exception, not the default secret path.

• The actor’s PVM Python code observes only ${KEY} placeholders. The PVM does not have a SecretBundle reference; substitution happens at the runner layer, after the syscall boundary.
• Direct os.environ[KEY] reads from PVM Python are blocked by the sandbox for any key declared in the actor’s secrets.read entitlement (deny-list installed at sandbox init).
• Logging adapters scrub strings matching active bundle values from spans and trace events on a best-effort basis. The primary defense is preventing PVM Python from ever holding the value.

​

4. Parameters

​

4.1 Gas

​

4.2 Stake / committee

Block-time basis (normative): this chain runs at 1 second per block (BLOCKS_PER_YEAR = 31_536_000, 1 day = 86_400 blocks, node/types/src/constants.rs). Every duration-in-blocks below is computed against 1 s/block. ⚠️ Deployed-value deltas (2026-07): a few defaults below are governance-tunable and the deployed value differs; the deployed value is authoritative until governance sets otherwise. PROXY_SOAK_PERIOD — deployed 100 (execution/src/cbss.rs, a devnet/launch-short soak), vs the ~30-day mainnet target. RESHARE_INTERVAL_BLOCKS — deployed 1_296_000 (~15 days, a deliberate demo-scale cadence), vs the ~6-month production default. MIN_PROXY_STAKE — deployed 1_000 CBY (CBSS_MIN_PROXY_STAKE), not 10,000; open decision cowboy#238. GOVERNANCE_REVIEW_BLOCKS — corrected to 2_592_000 in code (see cowboy#243). These economic/launch values are governance decisions, not spec-edited here.

​

4.3 Slashing schedule

• PlaintextLeak: evidence requires publishing the secret. Handled via off-chain disclosure → CIP-12 Tier 1 ForcedDeregisterCbssProxy.
• Liveness non-receipt: not provable on chain (packet delivery is not chain-witnessable). Handled via the §4.4 health score → governance review.

​

4.4 Health score

​

4.5 Quotas / limits

​

5. SDK surface (CIP-6 extension)

​

5.1 New entitlement

{ "id": "secrets.read",
  "params": {
    "keys": [
      "SLACK_API_KEY",
      "OPENAI_API_KEY",
      { "account": "0xacct1...", "key": "SHARED_API_KEY" }
    ]
  }
}

{ "id": "secrets.verify",
  "params": { "keys": [ "SLACK_SIGNING_SECRET" ] } }

​

5.2 Runner-op kwarg

await runner.http(
    "https://hooks.slack.com/services/...",
    headers={"Authorization": "Bearer ${SLACK_API_KEY}"},
    secrets=["SLACK_API_KEY"],
)

await runner.mcp(
    server="github",
    tool="create_issue",
    args={"token": "${GITHUB_TOKEN}", "title": "..."},
    secrets=["GITHUB_TOKEN"],
)

# Pin a specific version:
await runner.http(..., secrets=[("SLACK_API_KEY", {"version": 3})])

# Cross-account:
await runner.http(..., secrets=[("SHARED_API_KEY", {"account": "0xacct1..."})])

​

5.3 Errors

// Lookup / state failures
SecretNotFound                 // no SecretMetadata for (account, key_hash)
SecretVersionDeleted           // version was deleted by owner
SecretPending                  // override-path version awaiting FinalizeSecretVersion
SecretAccessDenied             // ACL or manifest entitlement does not permit (actor, runner) — including a
                               // purpose mismatch (§3.1, §5.5): a verify= key the actor does not hold under
                               // secrets.verify, or a secrets=[...] reference to a key held only under secrets.verify
SecretRequiresTEE              // policy.tee_required = true and runner has no valid CIP-23 attestation
SecretQuotaExceeded            // hit MAX_SECRETS_PER_ACCOUNT / MAX_VERSIONS_PER_SECRET / MAX_ACL_ACTORS / etc.
SecretCommitteeUnavailable     // < t proxies responsive at fetch time
SecretDkgInProgress            // initial ceremony in flight (account or secret-scoped override)
SecretsNotApplicableHere       // runner.llm with secrets=[...] but no server-side tool plumbing

// Setup-time failures
MissingAccountReleaseKey       // SetSecret-time failure on default path with no AccountReleaseKey on file
WrapEpochMismatch              // SetSecret/FinalizeSecretVersion: claimed wrap_epoch ≠ release_key.committee_epoch at submission
AadMismatch                    // wrapped_dek full-AAD mismatch (incl. wrong chain_id or substituted mpk_g2) or malformed len != 172 + 96 (268); expected u64_be(chain_id) || canonical(SecretId) || u64_le(version) || u64_le(wrap_epoch) || mpk_g2 || ephemeral_u, chain_id + mpk_g2 re-derived from committed state
UnsupportedWrappedDekVersion   // wrapped_dek.version != 2 — canonical typed error for unsupported envelope tags; implementations map local decode/validation failures to this taxonomy; §3.1
RecipientMismatch              // runner_request.body.recipient ≠ SecretVersion.recipient (anti-committee-substitution)

// Freshness / ordering
StaleRequestBlock              // body.request_block outside REQUEST_FRESHNESS_BLOCKS window
StaleChallenge                 // SubmitLivenessChallenge submitted after LIVENESS_CHALLENGE_MAX_AGE_BLOCKS from body.request_block
StaleCommitteeEpoch            // committee_epoch_at_serve neither current nor in retained prior_committee_epochs
EpochMismatch                  // proxy's current release_key.committee_epoch differs from body.serve_epoch (runner pinned a different epoch than the proxy's current view); runner must re-issue with fresh release_nonce + updated serve_epoch
ReshareGraceCapacity           // RotateCommittee would exceed MAX_PRIOR_COMMITTEE_EPOCHS; wait for grace window to expire

// Signature / proof failures
InvalidRunnerSignature         // runner_request.runner_sig fails verification against runner registry
InvalidProxySignature          // SubmitReleaseReceipt.proxy_sig or PartialSignResponse.proxy_sig fails verification
InvalidPartialReencrypt        // authenticated invalid/malformed blinded partial, or authenticated served_at_block outside [request_block, request_block + 384], even with a valid pairing; admission and authentication rules in §3.5 / §4.3

// Receipt / dedup failures
ReceiptAlreadyRecorded         // (release_id, proxy_id) already exists in release_receipt
ReceiptOrderingInvalid         // served_at_block < request_block, or > submission_block
QuorumAlreadyReached           // release_receipt:{release_id} already has t entries; additional receipts rejected (caps payment at quorum)
MixedEpochReceipts             // committee_epoch_at_serve ≠ body.serve_epoch / quorum_epoch initialized from the runner-pinned serve_epoch; reject (Lagrange combine requires single-polynomial partials)
ActorAccountInsufficient       // SubmitReleaseReceipt would push actor release debt past −MAX_RELEASE_OVERDRAFT; receipt rejected, proxy not paid for this attempt
LivenessChallengeAlreadyOpen   // (release_id, proxy_id) already has an open challenge (per-release dedup)
ChallengePremature             // SubmitLivenessChallenge submitted before MIN_CHALLENGE_DELAY_BLOCKS elapsed since body.request_block

// Time-lock release failures (§3.4.6)
TlockTagTooLong                // RegisterTlockRelease tag exceeds MAX_TLOCK_TAG_BYTES
TlockLeadTooShort              // RegisterTlockRelease target_height not > head + MIN_TLOCK_LEAD_BLOCKS
TlockAlreadyRegistered         // a TlockRequest for (scope, tag, target_height) already exists
TlockRegistrationCapExceeded   // MAX_TLOCK_REGISTRATIONS_PER_BLOCK reached for this block
TlockNotRegistered             // SubmitTlockRelease for an unregistered (scope, tag, target_height)
TlockNotYetReleasable          // SubmitTlockRelease while head < target_height (premature reveal)
TlockPartialAlreadySubmitted   // (scope, tag, target_height, proxy_id) already submitted (per-proxy dedup); the BLS pairing failure reuses InvalidPartialReencrypt

// Decryption failures (runner-side / SDK)
CiphertextCorrupted            // AES-GCM auth tag mismatch on wrapped_dek or CBFS object

// Inbound verification (§5.5 verify= / JobPrecondition)
JobPreconditionFailed             // verify= MAC mismatch on the runner; fail-closed and terminal (§5.5) —
                                  // no executor work, no read-set release, no retry/reassignment
JobPreconditionUnsupportedAlgo    // verify.algo not in the closed enum; admission-time reject
                                  // (node admission maps its `unsupported_algo` validation code here)
JobPreconditionMessageTooLarge    // verify.message exceeds the 64 KiB cap; admission-time reject before
                                  // any CBSS release (node: `message_too_large`)

​

5.4 CLI

cowboy secrets set <key> <value> [--actors=A,B] [--account=...] [--tee-required] [--committee-override] [--threshold=T/N]
cowboy secrets list [--account=...]
cowboy secrets versions <key>
cowboy secrets policy <key> [--add-actor=...] [--remove-actor=...] [--tee-required=true|false]
cowboy secrets delete <key> [--version=N]
cowboy proxy register --stake 10000CBY  # operator-side; publishes network_addr + HPKE public key
cowboy proxy status
cowboy proxy reshare-status

​

5.5 Inbound-verification precondition (verify=)

await runner.http(
    "https://internal.example.com/slack/handler",
    ...,
    verify=VerifyInput(
        secret=("SLACK_SIGNING_SECRET", {"account": "0xacct1..."}),
        message=raw_request_body,
        signature=x_slack_signature_header,
        # Provider-NEUTRAL crypto: Slack = HMAC-SHA256, hex, "v0=" prefix.
        # "Slack" lives in the actor, never on the wire or in consensus.
        algo=VerifyAlgo.Hmac(hash=Sha256, encoding=Hex, prefix=b"v0="),
    ),
)

JobPrecondition {
    secret_ref:  SecretKeyRef   // §3.1 — {account, key_hash}; not a plaintext key name
    message:     Bytes          // exact bytes the signature was computed over
    signature:   String         // algo-specific encoding
    algo:        VerifyAlgo     // closed enum
}

VerifyAlgo = Hmac { hash: MacHash, encoding: SigEncoding, prefix: Option<Bytes> }
MacHash     = Sha1 | Sha256          // closed enum, tags 0/1
SigEncoding = Base64 | Hex           // closed enum, tags 0/1

1. Message length cap. len(precondition.message) MUST NOT exceed 64 KiB (65536 bytes). A verify= request whose message exceeds the cap is rejected at admission, before verification is attempted.
2. Secret-ref-overlap rule (CIP-24 #37). precondition.secret_ref MUST NOT overlap — i.e., MUST NOT be the same {account, key_hash} pair — with any entry in the job’s secret_refs (the secrets= read set, §5.1/§5.2). A single job may verify a signature keyed by a given secret, or read that secret’s plaintext into the sandbox, but not both for the same {account, key_hash} in the same job.

​

6. Implementation notes

​

6.1 Crate layout

​

6.2 Runner-side SecretsClient trait

#[async_trait]
pub trait SecretsClient: Send + Sync {
    async fn fetch_for_op(
        &self,
        ctx: &JobContext,
        actor: ActorAddress,
        keys: &[SecretRef],            // (account, key, optional version)
    ) -> Result<SecretBundle, SecretsError>;
}

pub struct SecretBundle {
    entries: Vec<(SecretRef, Zeroizing<Vec<u8>>)>,
}

impl Drop for SecretBundle {
    fn drop(&mut self) { /* explicit zeroize per entry */ }
}

​

6.3 No persistent owner-side DEK cache

​

6.4 RPC additions

secrets_getMetadata(secret_id: SecretId, version_or_latest) → SecretMetadata
                  // SecretId = { account, key_hash }; raw RPC takes key_hash, not plaintext.
                  // SDK / CLI wrappers convert plaintext key_name → key_hash before calling.
secrets_getAccountReleaseKey(account) → AccountReleaseKey
secrets_getSecretReleaseKey(secret_id, version) → Option<SecretReleaseKey>   // Some iff override path
secrets_listProxies(filter) → Vec<CbssProxy>
secrets_getReleaseHistory(secret_id: SecretId, range) → Vec<SecretReleased>
proxy_health(proxy_id) → ProxyHealth
proxy_committees(proxy_id) → Vec<ActorAddress>     // which actors this proxy serves

​

7. Implementation tracking

​

8. Security considerations

​

8.1 The t-collusion question

• Operator diversity (governance): jurisdictional, software-version, hardware-source, organizational. Governance MAY refuse to admit registrations that concentrate the proxy set.
• Governance teeth on disclosed leaks: PlaintextLeak is NOT auto-slashable on chain (§4.3) because objective on-chain evidence would publish the secret. A disclosed leak triggers a CIP-12 Tier 1 governance proposal that, if passed, calls ForcedDeregisterCbssProxy(proxy_id) and routes the offending proxy’s stake to a remediation pool (default cap MAX_LEAK_REIMBURSEMENT). With MIN_PROXY_STAKE = 10,000 CBY and default t = 4, t-collusion still risks at least t × MIN_PROXY_STAKE plus permanent ban — but the slash is governance-mediated, not protocol-automatic.
• VRF committee selection: attacker cannot pre-position; committee membership is determined per-account at DKG time.
• Proactive reshare (insider rotation, NOT cryptographic invalidation): every RESHARE_INTERVAL_BLOCKS, the share polynomial rotates. PSS preserves MSK, so a retained old share can still partial-sign any historical-wrap_epoch identity off-chain — there is no cryptographic invalidation of old share material. What reshare DOES do: (a) replaces the share at-rest in cbssd’s storage (an honest proxy zeroizes per DeleteSecretVersion/reshare protocol), (b) rotates committee membership so previously-compromised proxies must be re-compromised under the new committee_epoch to keep contributing to t-of-n, (c) makes the prior committee no longer accepted by the chain for receipts past RESHARE_GRACE_BLOCKS. The honest-share-zeroization assumption is operational, not cryptographic. An exfiltrated share retains its contribution to offline threshold operations over historical identities. DeleteSecret removes the on-chain version rows and pointer and revokes subsequent chain-authorized release; it does not cryptographically invalidate copied shares, wrapped DEKs or ciphertext.
• Per-secret committee override: for secrets where the per-account blast radius is unacceptable, the committee_override path triggers a one-off DKG with its own committee, isolating that secret’s compromise surface from the rest of the account. Owners SHOULD use override for STRIPE_LIVE_KEY-class secrets and let routine credentials ride the account default.

​

8.2 Owner key compromise

​

8.3 Compromised runner

• Fetch secrets retroactively (release is anti-replayed per (job_id, secret_id, runner)).
• Impersonate other runners (signatures over runner registry key).
• Fetch secrets for jobs it isn’t currently assigned to (proxy validates dispatcher’s on-chain assignment).

​

8.4 Validator / dispatcher / chain-observer privacy

​

8.5 Anti-replay and freshness

• Per release: (release_id, proxy_id) is the dedup key. release_id is defined canonically in §3.5 next to ReleaseRequestBody; it is stable across request_block re-pinning and includes release_nonce, so legitimate second pulls within a job get a distinct release_id. Proxies maintain a 24-hour bloom keyed on (release_id, proxy_id); chain release_receipt:{release_id} → { quorum_epoch, entries: Map<ProxyId, ReleaseReceipt> } provides eventual-finality dedup and single-epoch quorum enforcement. request_hash (which includes request_block) is used only for sig verification on the specific request, not for dedup.
• Pinned-version pulls fail closed if the version was deleted (SecretVersionDeleted).
• wrap_epoch is read from the SecretVersion on chain (immutable per version); reshare does NOT invalidate in-flight requests since PSS preserves MSK and the proxy’s current share validly partial-signs any historical identity.

​

8.6 DKG correctness and liveness

• Correctness: Pedersen VSS commitments allow any party to verify share validity. A proxy submitting a malformed share is detectable and slashable for DkgSabotage.
• Liveness: if the ceremony fails to finalize within DKG_FINALIZE_BLOCKS, the requesting tx’s DKG bond is partially slashed and refunded; the owner may retry. Lean: VRF-select n + 2 proxies and require n to complete (over-sample for ceremony liveness).

​

8.7 Future-shock: cryptographic break

​

8.8 Comparison vs TEE-based release

​

9. Interaction with other CIPs

​

9.1 CIP-2 (Off-chain compute)

​

9.2 CIP-6 (SDK + entitlements)

​

9.3 CIP-9 (Runner storage)

​

9.3.1 Release-key material-hash binding (re-key safety)

1. cbss_release_key_material_hash is set (a zero hash is rejected);
2. cbss_rewrap_required == false;
3. the recorded hash equals the release-key material retained for the volume’s committee_epoch (release_key_view.material_hash).

​

9.4 Protocol opcode allocation and system-actor registry

​

9.5 CIP-23 (TEE Execution)

​

9.6 CIP-34 (Intent Settlement)

​

10. Rationale

​

10.1 Why threshold IBE on BLS12-381

​

10.2 Why per-account by default, with per-secret override

• Per-secret committees scale O(num_secrets × n) system-wide with a fresh DKG every time someone stores a credential. Bootstrap-prohibitive.
• Per-actor committees isolate an actor’s secrets from the rest of an account’s secrets, but the isolation only materializes when ACLs are narrow. Once a secret’s ACL fans out across multiple actors, an attacker just attacks the weakest of those committees — per-actor is no better than per-account in the wide-ACL case. Per-actor also pays a DKG every time you deploy a new actor, and forces a chain re-wrap on every ACL edit (since each ACL actor needs its own wrapped DEK). Operationally heavy with limited security gain in realistic usage patterns.
• Per-account committees match the practical sharing patterns of production secret management (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault are all account/project-scoped). Bootstrap is one DKG amortized over the account’s lifetime. ACL edits are pure metadata. Storage is O(1) wrapped DEK per version regardless of ACL size.

1. Tunable (n, t) per account — high-value accounts can raise n and t through governance-supported account parameters once larger vetted DKG quorums are enabled, instead of using the default (5, 4).
2. Per-secret committee override — a single high-value secret (STRIPE_LIVE_KEY) can opt into its own committee at SetSecret time, isolating its blast radius from the rest of the account’s secrets. This is the escape hatch.
3. Proactive resharing — every RESHARE_INTERVAL_BLOCKS, the share polynomial rotates. An attacker has a finite window.
4. Operator diversity governance — committee admission policy can require jurisdictional / vendor / org diversity.

​

10.3 Why a new operator role, not extending Relay Nodes

​

10.4 Why in-memory bundle by default (and explicit subprocess env when required)

​

10.5 Why two-layer access control (manifest ∩ ACL)

​

10.7 Why MPK is preserved on reshare

​

10.8 Why per-proxy receipts, not a single aggregate RecordSecretRelease

• Runner is removed from the payment path. Cannot grief proxies by withholding submission.
• No coordination required. Each proxy decides independently when to submit; the first t proxies to land on chain are paid; later submissions for the same release_id (whether from the n-t over-fanout or from the same proxy on a re-pin) are rejected. Proxies SHOULD watch release_receipt:{release_id}.entries and stop attempting once entries.len() == t.
• Auditable. release_receipt:{release_id} → { quorum_epoch, entries: Map<ProxyId, ReleaseReceipt> } accumulates the full t-of-n proof of release on chain, each entry carrying the verbatim runner-signed request and the verified σ_i. The SecretReleased event fires when the t-th entry lands, carrying the actual proxy_set of t contributors.
• Cost: t txs per release instead of one. Acceptable for a system whose default release rate is O(1 per actor-job); for very-high-frequency cases, an aggregator pattern is possible later without breaking the on-chain interface.