aaronrene / knowtation public
BREAKING feat/sec-kn-6-constant-time-secret-compare #1 / 1
aaronrene · 40 days ago · Jul 27, 2026 · Diff

SEC-KN-6 DONE: constant-time gateway/operator secret compare.

P14: replace early-exit got == expected with constantTimeTextEqual (OR-of-XOR full scan) in gatewayAuthorized and operatorExportAuthorized. JS mirror + seven-tier tests with security regression vs length-then-==. Build verification round 1 = pass. Motoko compile verified. Governance sync (SD-17): ROADMAP + OVERSEER-HANDOVER. NEXT = SEC-SEAM-1. T1-T4 not executed. No merge, no deploy.

sha256:bb86e8d2c5951a726738b7773e3016fd1d22acb61723fb1f488659b3112006ce sha
sha256:e2d9ce01ed1ec04982dac8503908c2bf2042c3924fde0a4bd759b22e8dabccbb parent
+12 ~18 symbols
sha256:6a3f7106e5bf6f97f569012ae90e962519454c4f6d140d6f2c026e0c30015d71 snapshot
+12
symbols added
~18
symbols modified
0
dead code introduced
Semantic Changes 30 symbols
~ test/sec-kn-6-constant-time-secret-compare.test.mjs .mjs 6 symbols added
+ decide function function decide L156–170
+ earlyExitInstrumented function function earlyExitInstrumented L298–305
+ extractFuncBlock function function extractFuncBlock L42–61
+ fixedInstrumented function function fixedInstrumented L307–317
+ motokoStyleEqualLegacy function function motokoStyleEqualLegacy L70–73
+ readMainMo function function readMainMo L31–33
~ docs/OVERSEER-HANDOVER.md .md 3 symbols added, 12 symbols modified
~ NEXT SESSION — SEC-KN-6 (PRIMARY)
~ Prior session — SEC-KN-5 BV round 1 = pass
~ code[text]
+ NEXT SESSION — SEC-SEAM-1 (PRIMARY) section NEXT SESSION — SEC-SEAM-1 (PRIMARY) L20–54
+ Prior session — SEC-KN-6 BV round 1 = pass section Prior session — SEC-KN-6 BV round 1 = pass L44–54
+ code[text] variable variable code[text] L30–43
~ Overseer Handover — Knowtation
~ Change log
~ table
~ NEXT SESSION — archived SEC-KN-4b build prompt
~ Governance gates checklist
~ Knowtation-owned findings (from Pass 2)
~ table
~ Verified snapshot (what exists now)
~ table
~ docs/ROADMAP.md .md 5 symbols modified
~ Roadmap — knowtation
~ Build queue
~ table
~ Current status (2026-07-26)
~ table
~ hub/icp/src/hub/main.mo .mo
~ lib/gateway-authorized.mjs .mjs 3 symbols added, 1 symbol modified
+ constantTimeTextEqual function function constantTimeTextEqual L28–38
+ operatorExportAuthorized function function operatorExportAuthorized L77–83
+ textEqualEarlyExitLegacy function function textEqualEarlyExitLegacy L48–55
~ gatewayAuthorized
← Older Oldest on feat/sec-kn-6-constant-time-secret-compare
All commits
Newer → Latest on feat/sec-kn-6-constant-time-secret-compare

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:bb86e8d2c5951a726738b7773e3016fd1d22acb61723fb1f488659b3112006ce --body "your comment"