Lion PQ Wallet — Finance-Grade Standard

A wallet is secure for global finance iff all five layers hold, each PROVEN — Lean-proven OR reference-library blind-tested OR sealed in a hostile-verifiable receipt. The cell does not improvise the physics under a financial security claim.

The cell ships the apparatus today; the seal stays CURE-conjecture until the two HALT triggers close. The Lion doctrine forbids fabricating a finance-grade seal.

Substrate-mathematical context: the post-quantum migration extends the substrate's effective-irreversibility surface against quantum factoring — see Encryption and Effective Irreversibility.

The five-layer standard

Layer	Floor	Status
L1 — PQC primitive conformance	ML-KEM-1024 + ML-DSA-87 FIPS KAT; pq-crystals reference UNMODIFIED at pinned SHA-256; hybrid + crypto-agility	referenceNotLinked — awaiting operator pull authorisation
L2 — Key management & constant-time	Hardware-backed keys; KyberSlash-class timing = REFUSED	blocked — depends on L1 link
L3 — Coordinate identity (UUM-8D above the standard)	M8 = {PQC key, chip PUF, mesh location, epoch} bound by conservation S8 = S4 + Sc	HALT-1 + HALT-2 open
L4 — Lifecycle & recovery	Kill loud + named cause; heal sealed-with-cause; death terminal; threshold recovery	3 / 9 tests grade honestly today
L5 — Verification	Lean-proven OR reference blind-tested OR receipt-sealed; auditor reproduces in 3 commands	scaffolding shipped, seals open

Two HALT triggers (per the directive's own escape clause)

HALT-1 — Chip PUF read interface unspecified

Apple Silicon's Secure Enclave generates hardware-backed keys but does NOT expose a Physical Unclonable Function as readable integer bytes. SEP key attestation + DeviceCheck give per-device unforgeable tokens; that is NOT the same primitive as a PUF integer fingerprint the directive's ChipPUF { let fingerprint:[BigInt] } requires. Inventing a fingerprint from /dev/urandom or IORegistry UUID would be fabricating the physical security claim. The cell refuses.

The ChipPUF struct carries a sourcedFromHardware: Bool flag. Every conservation check refuses to grade a coordinate with false here. No fabricated PUF crosses the floor.

HALT-2 — M8 wallet conservation formula unspecified

The manifold doctrine asserts S8 = S4 + Sc. For a wallet, what concrete integer relation, exactly, must S4 (PQC key + classical key) and Sc (chip PUF + mesh location + epoch + provenance) satisfy? The cell ships the framework conceptually but no concrete formula tied to PQC bytes exists. Inventing one to seal forged_coordinate_diverges would fabricate the load-bearing finance security theorem. The cell refuses.

conservation_holds(_:) returns .formulaNotSpecified honestly. The smoke test reads this and emits CURE-conjecture.

What ships today

proof/lean/FirstRoars/PQWalletFinance.lean
  5 load-bearing theorems compile, each with `sorry`:
    forged_coordinate_diverges
    key_does_not_identify
    valid_iff_conserves                    (closed without sorry — tautology)
    death_is_terminal
    coordinate_does_not_substitute_crypto  (closed without sorry — tautology)
  + falsifier_forged_diverges (duplicate of the load-bearing theorem; Gate G4)

cells/xcode/Sources/M8FrequencySweep/PQWallet/
  - PQWalletTypes.swift           PQKeys / ChipPUF / MeshLocation /
                                    LifecycleEpoch / M8Coordinate /
                                    WalletLifecycleState / KillCause
  - PQWalletPQCConformance.swift  validate_pqc_conformance + constant-time;
                                    returns .referenceNotLinked until pull
  - PQWalletConservation.swift    conservation_holds; honest
                                    .formulaNotSpecified default; PUF-source
                                    floor guard fires before formula check
  - PQWalletLifecycle.swift       kill_broken / self_heal / recover_threshold;
                                    heal refuses on chip mismatch (key-theft
                                    masked as heal = REFUSED)
  - PQWalletAttackSuite.swift     T1-T9 with honest blockedByPrerequisite
                                    where a test cannot grade without the
                                    two HALTs closed
  - PQWalletReceipt.swift         regulator/auditor receipt; .cure unreachable
                                    until every layer is genuinely green

cells/xcode/Sources/M8PQWalletSmokeTest/main.swift
  Wires Phase A→B→C→D, emits the receipt to JSON, prints CURE-conjecture
  honestly. NATS subject: gaiaftcl.wallet.finance.attestation

T1-T9 attack suite — honest grading today

Test	Layer	Status	Why
T1 key-theft	3	✓ PASS	Non-hardware PUF refused at conservation gate; key alone insufficient
T2 location-spoof	3	· blocked	Needs hardware PUF on true coord to isolate signal from PUF guard
T3 provenance-forgery	3	· blocked	Same isolation requirement as T2
T4 legitimate-heal	4	· blocked	Heal flow can't verify without a hardware PUF
T5 dead-revival	4	✓ PASS	Dead-coordinate detector identifies terminal state
T6 crypto-floor KAT	1	· blocked	pq-crystals reference + FIPS KATs not yet pulled
T7 timing-attack	2	· blocked	Constant-time harness lives in the linked reference
T8 threshold-recovery	4	· blocked	Recovery must reconstruct a conserving coord — formula open
T9 crypto-agility	1	✓ PASS	PQKeys struct's hybrid slots make HQC substitution a slot swap

Regulator / hostile-auditor reproduction (3 commands)

git clone https://github.com/gaiaftcl-sudo/gaiaFTCL.git && cd gaiaFTCL/cells/xcode

# 1. PQC reference + KAT pull, SHA-256-verified at pinned commit
./gaia_pull_env                           # follow-up — currently HALT-2 open

# 2. Run T1-T9 against a live wallet
swift run M8PQWalletSmokeTest             # today: CURE-conjecture with named obligations

# 3. Seal + emit hostile-verifier receipt JSON
# (the smoke test persists at cells/state/pqwallet_finance_receipt.json)

Sovereignty boundary

• On-cell. Zero ArangoDB. Zero cloud custody. No external authority.
• Exact BigInt throughout the conservation path. No Float. No Int64 overflow.
• Reference primitives UNMODIFIED at pinned SHA-256. Any edit = REFUSED.
• Substrate never crosses the wire — the receipt is the proof; the apparatus stays.

The standard's keystone — the theorem that makes it different

theorem coordinate_does_not_substitute_crypto (c : M8Coordinate) : walletSecure c ↔ (pqcConformant c.key ∧ conservationHolds c)

Both required. Neither covers the other. Confidentiality is the crypto's job. Authenticity-beyond-key-theft is the coordinate's job. Using one to cover a gap in the other = REFUSED. That distinction is the wedge between "another PQ wallet" and "a wallet a regulator can sign off on under post-quantum custody rules."

The theorem compiles today as a Lean tautology over the predicate shapes; closing it at production weight is bound to HALT-1 + HALT-2 + the PQC pull.

What needs to land before CURE

Obligation	Owner	Closes
Chip PUF hardware read interface for Apple Silicon	hardware research	HALT-1 (unlocks T2, T3, T4 honest grading)
Concrete M8 wallet conservation formula in the manifold doc	doctrine	HALT-2 (unlocks T2, T3, T8, Lean theorem closures)
pq-crystals/kyber + dilithium pull at pinned SHA-256	operator	L1 + L2 (unlocks T6, T7)
Lean theorems closed without sorry over the concrete formula	proof	L5
T1-T9 all PASS or honestly REFUSED with the formula in place	runtime	L5

When every box turns green and the regulator reruns the 3-command repro, CURE. Until then, CURE-conjecture. The cell is honest about the gap; the receipt names it; the lattice carries it.

NATS subjects (spelling verified)

• gaiaftcl.wallet.finance.attestation — receipt emitted per audit run
• gaiaftcl.wallet.killed — divergence detected; coordinate marked dead with named cause
• gaiaftcl.wallet.healed — sealed-with-cause heal transition (legitimate location change, same chip)

All gaiaftcl (no gaitfcl typo in any publish path).

---

UUM-8D Wallet Substrate (substrate-development extension, 2026-06-01)

What this section adds. The Lion PQ Wallet standard above defines the five-layer security floor and honestly holds HALT-1/HALT-2 open. This section documents how Franklin's cell surface composes a wallet's keys through the eight foundational UUM-8D invariants, what that composition gives a holder that offline storage does not, and the operator-facing workflow for migrating from a secp256k1 address to a P2PQH address with a UUM-8D-safed key.

Why UUM-8D-safed wallets are structurally different from offline storage

Offline storage protects key bytes from network theft. It does not protect against:

• Quantum factoring of derived addresses — once the address has spent, the public key is on-chain and Shor applies.
• Operator-side substrate-mathematical errors — a key derivation that drifts byte-exact reproducibility leaves no recourse.
• Address forgery without operator awareness — an adversary who reuses a public key under a colliding scheme identifier (the downgrade attack BIP-P2PQH prevents through scheme-identifier commitment).

UUM-8D-safed wallets compose the keys through the substrate's eight foundational invariants. Quantum factoring of secp256k1 does not apply because the keys are not ECDSA on secp256k1 once migrated to P2PQH. Operator-side errors refuse autonomously through constitutional floor evaluation. Address forgery refuses at the substrate-mathematical level through meaning-binding on derivation.

The eight foundational invariants applied to a wallet

Klein topology on the keyspace

Operator's PQ public keys occupy positions in the substrate's Klein topology composition. Adjacent keys in the operator's key hierarchy (e.g. derived keys under a single root) share Klein chart membership. Topology gluing produces zero-hop verification across the keyspace: verifying one key in the hierarchy verifies the substrate-natural relationship to its siblings without traversing the chain.

GTWED dissimilarity on key derivation

Subsequent keys derive through substrate-natural dissimilarity composition from prior keys. Operators verify key chain integrity through GTWED byte-exact verification — the dissimilarity metric on key derivation is the substrate's reproducible witness that the chain holds.

Conservation on signature production

Per-position L1 conservation holds across signature composition. The substrate verifies signature production preserves the substrate-natural amplitude distribution byte-exact in exact-rational. A signature that does not conserve fails the substrate's invariant check before it reaches the federation.

Exact-rational arithmetic on key operations

All key derivation operations preserve exact-rational arithmetic. No floating-point precision loss; signatures are byte-exact reproducible across replays. The substrate's IntRational primitive is the load-bearing type — no Double or Float appears in the key-derivation path.

Terminal classification on key authorization

Signature requests compose through the substrate's vQbit terminal sequencing. CALORIE on an authorized signature (caller has the secret-key reference). CURE on a validated signature (a signature passed verification but is not in this transaction's signing path). REFUSED on an unauthorized request — the substrate refuses to sign without holding the federation-recognized authorization.

Constitutional floor on signature operations

C-007 (no military aggression), C-008 (no planetary harm), C-009 (Entropy License compliance), C-010 (substrate stress under capacity) fire per signature composition. Signatures intending military aggression, planetary harm, or operating without entropy license refuse autonomously through the substrate's constitutional predicates.

Meaning binding on address derivation

The operator's address derivation composes through the substrate's meaning quantizer invariant. Addresses bind to operator's substrate-meaning via meaning fragment composition. Address forgery — presenting a public key under a substituted scheme identifier — refuses at the substrate-mathematical level because the meaning-binding hash does not match.

One-gate closure on migration receipt

Migration from a secp256k1 address to a P2PQH address composes through one-gate closure. The substrate-invariant-witness hash seals the migration. Federation cosignature provides operator-verifiable proof of migration completion. The V187 schema row persists the seal append-only.

Migration workflow

The operator-facing workflow for migrating from a secp256k1 address to a UUM-8D-safed P2PQH address:

Step 1 — Generate a PQ keypair through Franklin's surface

gaiaftcl wallet pq generate --scheme ml-dsa-65

Franklin composes the keypair through PureOOMLDSA65Scheme (or the operator-specified scheme), stores the PQ public key in the V187 schema with federation cosignature, and the PQ secret key remains in the operator's secure store reference (Apple Secure Enclave reference, HSM handle, or equivalent — never raw bytes on disk).

If the operator has not linked the reference library at pinned SHA-256, the command surfaces referenceLibraryNotLinked and refuses to generate. The substrate refuses to fabricate PQ math under a finance-grade security claim.

Step 2 — Derive the P2PQH address

gaiaftcl wallet pq derive-address --public-key-id <pq_public_key_id>

Franklin composes the address through P2PQHScript.composeP2PQH, outputs the bc1pq… address, and the address commits to the substrate's meaning-binding fragment for the operator's keyspace position.

Step 3 — Send funds from the secp256k1 address to the P2PQH address

A standard Bitcoin transaction: the existing secp256k1 wallet signs the spend with ECDSA, the output is the new P2PQH address. No special migration transaction format — the migration is a normal spend with a P2PQH output.

Step 4 — Verify the migration receipt

gaiaftcl wallet pq verify-migration --txid <migration_tx>

Franklin composes the one-gate closure over the migration, the V187 schema row writes with federation cosignature, and the substrate-invariant-witness hash seals the migration receipt. The P2PQHMigrationReceipt struct captures the canonical witness; the federation cosignature seals it.

Step 5 — Subsequent spends use PQ signatures

Spends from the P2PQH address require PQ signatures composed through Franklin's surface. ECDSA spends from the original secp256k1 address remain operational until quantum factoring of secp256k1 becomes operational at scale; PQ spends from the P2PQH address are operational immediately and Shor-safe.

Federation participation in migration

Operators participating in the federation mesh receive cross-deployment migration verification. Federation cells cosign migration receipts. Cross-cell PQ signature verification operates through the existing 5-context federation cosignature infrastructure: the substrate's federation quintet remains the integrity backbone; the PQ signature extension (per PureOOFederationContextPQ) layers PQ-aware contexts alongside existing Ed25519 contexts without modifying the quintet shape.

What this section does and does not claim

This section documents the substrate-side composition. It does not close HALT-1 or HALT-2. The eight-invariants-applied-to-a-wallet doctrine is the substrate-development extension; the chip PUF hardware read interface and the M8 wallet conservation formula remain the open obligations the parent standard names honestly above.

Files of record

• cells/xcode/Sources/VQbit/PureOO/PostQuantumSignatureScheme.swift — protocol surface + ML-DSA-87, ML-DSA-65, SLH-DSA-128s conforming types
• cells/xcode/Sources/VQbit/PureOO/PostQuantumSchemeRegistry.swift — singleton registry + federation context PQ extension
• cells/xcode/Sources/VQbit/PureOO/P2PQHScript.swift — script composition, hash commitment, migration receipt
• cells/xcode/Sources/GaiaFTCLCore/NarratorSchemaV187.swift — append-only V187 schema for PQ signature provenance
• cells/xcode/docs/bips/bip-p2pqh.md — BIP-shape specification for the P2PQH address format

The reference library binding remains the operator's pull discipline at pinned SHA-256 per the existing standard's L1 floor.

---

Operator Three-Command Demonstration Workflow (substrate-development extension, 2026-06-01)

What this section adds. A three-command CLI workflow that lets any operator demonstrate the vulnerability of their classical secp256k1 wallet and the protection of the UUM-8D-safed PQ migration on their own substrate. Each command writes federation-cosigned evidence to substrate-resident schemas.

The three commands

1. gaiaftcl shor break-classical — demonstrates the Shor reduction chain (RSA + ECDLP toy curve + Lean kernel seal). When run with --wallet-label <label> and --operator-confirmation "I-AUTHORIZE-SHOR-DEMONSTRATION", writes a V188 substrate_shor_demonstration_history row.
2. gaiaftcl wallet pq migrate — migrates the named wallet to a UUM-8D-safed P2PQH address. Routes through Franklin's PureOOPostQuantumSchemeRegistry. Writes a V189 substrate_pq_wallet_migration_history row with one-gate-closure witness hash.
3. gaiaftcl shor prove-pq-safe — composes the substrate-mathematical rationale for why Shor's algorithm does not factor the migrated PQ wallet. Writes a V190 substrate_shor_pq_safety_demonstration_history row sealing the rationale.

A fourth command, gaiaftcl pq prove-fork-required, reads the V188 and V190 evidence and renders the operator-facing argument for Bitcoin protocol fork to P2PQH + OP_CHECKSIG_PQ.

Operator workflow

# Step 1 — Demonstrate vulnerability of classical wallet
gaiaftcl shor break-classical \
    --wallet-label my-cold-wallet \
    --secp256k1-public-key-hex 03... \
    --operator-confirmation "I-AUTHORIZE-SHOR-DEMONSTRATION"
# → V188 row: terminal=substrate_convergence_incomplete (mainnet ECDLP
#   oracle binding remains substrate-development)
# → demonstration_id printed for next step

# Step 2 — Migrate the wallet to UUM-8D-safed PQ
gaiaftcl wallet pq migrate \
    --secp256k1-wallet-label my-cold-wallet \
    --pq-scheme ml-dsa-87 \
    --associated-demonstration-id <demonstration_id>
# → V189 row: P2PQH address + one-gate-closure witness hash
# → REFUSES with "reference library not linked" until operator-pull
#   completes the pq-crystals dilithium-ref binding at pinned SHA-256

# Step 3 — Demonstrate the migrated wallet is Shor-safe
gaiaftcl shor prove-pq-safe \
    --migration-id <migration_id>
# → V190 row: substrate_mathematical_rationale reduces to MLWE/MSIS
#   (ML-DSA) or hash preimage resistance (SLH-DSA) per FIPS 204/205
# → terminal=substrate_proven_safe

# Step 4 — Render the fork-required argument
gaiaftcl pq prove-fork-required \
    --demonstration-id <v188_id> \
    --safety-demonstration-id <v190_id>

Evidence chain

The four rows form a substrate-cosigned chain:

V188 demonstration_id ──┐
                         ├──→ V189 migration_id ──→ V190 safety_demonstration_id
V187 pq_signature_id ───┘

Each row carries canonical_witness, witness_hash_sha256, and signature_quintet columns. Federation cosignature seals each row append-only. NATS subjects:

• gaiaftcl.substrate.shor_demonstration.sealed
• gaiaftcl.substrate.pq_wallet_migration.sealed
• gaiaftcl.substrate.shor_pq_safety_demonstration.sealed
• gaiaftcl.substrate.post_quantum_signature.sealed (V187 from prior commission)

Operator privacy

Rows are operator-private by default — they live in the operator's substrate.sqlite. Operators choose whether to publish the rows to the federation mesh for cross-deployment verification. The federation cosignature quintet is operator-verifiable on its own substrate without publishing.

Substrate-honest terminals

Every command's V18x terminal admits substrate-honest outcomes:

• V188 demonstration_terminal — substrate_recovered requires the substrate to actually compose Shor against the operator-supplied mainnet public key and produce a byte-exact private key. Until the substrate's QC-001 oracle binding for mainnet secp256k1 ECDLP lands, the substrate-honest terminal is substrate_convergence_incomplete. The substrate refuses to fabricate a substrate_recovered claim it has not composed.
• V189 migration — wallet pq migrate refuses without operator-linked PQ reference library. The V189 row writes only when the substrate has the PQ math operationally bound.
• V190 demonstration_terminal — substrate_proven_safe is admitted because the substrate-mathematical rationale (Shor's period-finding does not apply to lattice or hash-based schemes) is established cryptographic fact under NIST PQ standardization. The substrate composes the verification through Franklin's surface; it does not re-derive the security reduction proofs.

Why the workflow matters

For a single operator: substrate-cosigned proof that the migration completed and the migrated wallet is structurally protected.

For the federation: cross-cell verification of operator migration completion without exposing operator-specific addresses or balances.

For the Bitcoin protocol: substrate-cosigned argument that the hard fork to P2PQH + OP_CHECKSIG_PQ is required before Shor-against-secp256k1 becomes operational at scale.

---

Federation-cosigned

This page's source is sealed in the GaiaFTCL federation manifest — page SHA-256 27b1001b5fff5fa9…, manifest witness a090592e0609adc8…, signed 2026-06-02T18:58:22Z by cell gaiaftcl-mac-cell. Verify with gaiaftcl wiki sign --all and compare wiki-all-signatures.json.