test(frost): cover the batch's failure modes and its crypto without a database

Phase 6 of docs/frost-batch-signing.md. 361 jvmTest and 227 testDebugUnitTest
pass.

## Inbound path (SignedGroupKeyStateTest)

Both drive the manager with a hand-built inner event rather than one the other
device queued, which is the only way to be a faulty or dishonest member in this
harness.

- A one-value nonce offered for a three-item batch does not count towards the
  threshold: the coordinator never reaches a signer set. The length check is all
  that stands between a batch and a signer whose contribution lines up against
  the wrong messages, so truncating or padding would produce partial signatures
  aggregated against events nobody agreed to. The test then pumps the real nonce
  and the batch completes -- it is a stall, not damage, which is
  FrostSignerMessage's composite key doing its job.
- A second proposal under the session's own id changes neither its event ids nor
  its seeds. Every seed is already committed to its item's message; a different
  batch under the same id would have those seeds produce a second partial
  signature over a second message, which is how a share is extracted.

## Real FROST, no database (FrostSigningRoundTest)

- A k=3 batch from one signer set, all three verifying against the room's key --
  the manager's shape with the database taken out of the way.
- Item 0's signature does not verify against item 1. Signing three events in
  lockstep must not make any of them interchangeable.
- Both halves of the no-shared-nonce property, because either alone is enough to
  be relied on by accident: SecretNonce.generate mixes the message in, so one
  seed under two messages already gives two nonces -- and the manager mints
  distinct seeds regardless.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

composeApp/src/commonTest/kotlin/press/mantra/compose/managers/FrostSigningRoundTest.kt

@@ -160,6 +160,105 @@ class FrostSigningRoundTest {
         )
     }
 
+    @Test
+    fun `one signer set signs a batch of three, and every signature verifies`() {
+        // The manager's batch, with the database taken out of the way: one signer
+        // set and one tweak cache shared, and a nonce, a Session and a signature
+        // per event. If any of that is wired up wrongly the aggregate simply
+        // fails to verify, which is the whole reason this file exists.
+        val ids = listOf("first", "second", "third").map(::eventId)
+        val messages = ids.map { ByteVector(it.hexToByteArray()) }
+
+        val signerIds = listOf(0, 1)
+
+        // A seed per signer per item. The manager mints these independently; here
+        // they only have to differ, which is the property under test.
+        val nonces = signerIds.map { signerId ->
+            messages.mapIndexed { index, message ->
+                nonceOf(signerId, message, "f".repeat(62) + "$index${signerId + 1}")
+            }
+        }
+
+        val signatures = messages.mapIndexed { index, message ->
+            val session = sessionFor(signerIds, nonces.map { it[index].second }, message)
+
+            val partials = signerIds.mapIndexed { position, signerId ->
+                session.sign(
+                    nonces[position][index].first,
+                    keyMaterial.secretShares[signerId],
+                    signerId.toUInt()
+                ).right!!
+            }
+
+            session.aggregateSigs(partials).right!!
+        }
+
+        ids.forEachIndexed { index, id ->
+            assertTrue(
+                Nip01Crypto.verify(
+                    signature = signatures[index].toByteArray(),
+                    hash = id.hexToByteArray(),
+                    pubKey = groupPubKey.hexToByteArray()
+                ),
+                "item $index of the batch must verify against the room's own key"
+            )
+        }
+    }
+
+    @Test
+    fun `a batch signature does not carry to another item of the same batch`() {
+        // What keeps a batch k independent signatures rather than one loose one.
+        // Signing three events in lockstep must not make any of them
+        // interchangeable.
+        val ids = listOf("first", "second").map(::eventId)
+        val messages = ids.map { ByteVector(it.hexToByteArray()) }
+        val signerIds = listOf(0, 1)
+
+        val nonces = signerIds.map { signerId ->
+            messages.mapIndexed { index, message ->
+                nonceOf(signerId, message, "9".repeat(62) + "$index${signerId + 1}")
+            }
+        }
+
+        val session = sessionFor(signerIds, nonces.map { it[0].second }, messages[0])
+        val partials = signerIds.mapIndexed { position, signerId ->
+            session.sign(
+                nonces[position][0].first,
+                keyMaterial.secretShares[signerId],
+                signerId.toUInt()
+            ).right!!
+        }
+        val first = session.aggregateSigs(partials).right!!
+
+        assertFalse(
+            Nip01Crypto.verify(
+                signature = first.toByteArray(),
+                hash = ids[1].hexToByteArray(),
+                pubKey = groupPubKey.hexToByteArray()
+            ),
+            "item 0's signature must not verify against item 1"
+        )
+    }
+
+    @Test
+    fun `two items of a batch never share a nonce`() {
+        // The one mistake in this whole design that loses the key, asserted at the
+        // level where it would be made. `SecretNonce.generate` mixes the message
+        // in, so two items of a batch cannot collide even given the same seed --
+        // but the manager gives them distinct seeds as well, and both halves are
+        // checked here because either alone is enough to be relied on by accident.
+        val messages = listOf("first", "second").map { ByteVector(eventId(it).hexToByteArray()) }
+
+        val sameSeed = messages.map { nonceOf(0, it, "7".repeat(64)).second.data.toHex() }
+        assertEquals(2, sameSeed.toSet().size, "one seed under two messages must give two nonces")
+
+        val distinctSeeds = messages.mapIndexed { index, message ->
+            nonceOf(0, message, "8".repeat(63) + "$index").second.data.toHex()
+        }
+        assertEquals(2, distinctSeeds.toSet().size)
+        assertEquals(emptySet(), sameSeed.toSet().intersect(distinctSeeds.toSet()))
+    }
+
     @Test
     fun `a signature over one event does not verify against another`() {
         val id = eventId("the group agrees")

composeApp/src/jvmTest/kotlin/press/mantra/compose/managers/SignedGroupKeyStateTest.kt

@@ -646,6 +646,118 @@ class SignedGroupKeyStateTest {
         Unit
     }
 
+    /**
+     * A payload that is not the batch's length is left out, not truncated -- and
+     * leaving it out stalls the session rather than poisoning it.
+     *
+     * The length check is the only thing standing between a batch and a signer
+     * whose contribution lines up against the wrong messages. Truncating a long
+     * payload or padding a short one would produce partial signatures aggregated
+     * against events nobody agreed to.
+     */
+    @Test
+    fun `a nonce payload of the wrong length is left out rather than truncated`() = runBlocking {
+        val creator = device(members[0], signerIndex = 0)
+        val other = device(members[1], signerIndex = 1)
+
+        val session = FrostSigningManager.proposeSigningBatch(
+            database = creator.db,
+            localChatRoom = creator.room,
+            userPublicKey = creator.publicKey,
+            events = dialects()
+        )
+        pump(creator, other)
+
+        // One nonce offered for a batch of three, from a member the coordinator
+        // would otherwise have picked.
+        FrostSigningManager.processSigningPayload(
+            database = creator.db,
+            localChatRoom = creator.room,
+            innerEvent = Event(
+                id = "1".repeat(64),
+                pubKey = other.publicKey,
+                createdAt = 1,
+                kind = FrostSigningEvents.NONCE,
+                tags = FrostSigningEvents.assembleTags(session.id),
+                content = "aa".repeat(66),
+                sig = ""
+            ),
+            userPublicKey = creator.publicKey
+        )
+
+        assertNull(
+            creator.session(session.id)?.signerIds,
+            "a payload of the wrong length must not count towards the threshold"
+        )
+
+        // And it is a stall, not damage: the real nonce replaces it and the batch
+        // finishes. That is the composite key on FrostSignerMessage doing its job.
+        FrostSigningManager.approve(other.db, other.room, session.id)
+        pump(creator, other)
+
+        assertEquals(FrostSigningStage.COMPLETE, creator.session(session.id)?.stage)
+        assertEquals(3, creator.items(session.id).count { it.signature != null })
+    }
+
+    /**
+     * A second proposal under a session's own id cannot change what it signs.
+     *
+     * The rule the whole design rests on. Every item's nonce seed is already
+     * committed to that item's message; giving the session a different batch
+     * would have those seeds produce a second partial signature over a second
+     * message, which is how a secret share is extracted.
+     */
+    @Test
+    fun `a second proposal under the same id cannot change what a session signs`() = runBlocking {
+        val creator = device(members[0], signerIndex = 0)
+        val other = device(members[1], signerIndex = 1)
+
+        val session = FrostSigningManager.proposeSigningBatch(
+            database = creator.db,
+            localChatRoom = creator.room,
+            userPublicKey = creator.publicKey,
+            events = dialects()
+        )
+        pump(creator, other)
+
+        val before = other.items(session.id)
+
+        val substitute = DialectEvent.build(name = "Xitsonga", country = "ZA", language = "tso")
+        FrostSigningManager.processSigningPayload(
+            database = other.db,
+            localChatRoom = other.room,
+            innerEvent = Event(
+                id = "2".repeat(64),
+                pubKey = creator.publicKey,
+                createdAt = 1,
+                kind = FrostSigningEvents.PROPOSAL,
+                tags = FrostSigningEvents.assembleTags(session.id, dkgSessionId = ceremonyId),
+                content = FrostSigningEvents.encodeProposal(
+                    listOf(
+                        Event(
+                            id = "3".repeat(64),
+                            pubKey = adminRoomId,
+                            createdAt = substitute.createdAt,
+                            kind = substitute.kind,
+                            tags = substitute.tags,
+                            content = substitute.content,
+                            sig = ""
+                        )
+                    )
+                ),
+                sig = ""
+            ),
+            userPublicKey = other.publicKey
+        )
+
+        assertEquals(
+            before.map { it.eventId },
+            other.items(session.id).map { it.eventId },
+            "a re-proposal must be ignored, not applied"
+        )
+        assertEquals(before.map { it.nonceRandom }, other.items(session.id).map { it.nonceRandom })
+    }
+
     /** Three dialects, distinct enough that an order bug shows up as a wrong name. */
     private fun dialects() = listOf(
         Triple("Sepedi", "ZA", "nso"),

docs/frost-batch-signing.md

@@ -423,14 +423,28 @@ sharing costs is the secret share, to anyone who sees both partial signatures.
 It is the cheapest possible guard against the one mistake in this document that
 loses the key, and it catches an index bug nothing else here would.
 
-Then, still to write:
+Then two on the inbound path, driven by handing the manager a hand-built inner
+event rather than one the other device queued — which is the only way to be a
+faulty or dishonest member in this harness:
 
-- a wrong-length payload is dropped rather than truncated;
-- a second proposal under the same session id with a changed item is ignored;
-- a `k = 3` batch in
-  [FrostSigningRoundTest](../composeApp/src/commonTest/kotlin/press/mantra/compose/managers/FrostSigningRoundTest.kt),
-  against real FROST and no database, for the same reason that file exists at
-  all: the library calls are checked without a database in the way.
+- **a wrong-length payload is left out, not truncated.** The length check is all
+  that stands between a batch and a signer whose contribution lines up against
+  the wrong messages. Assert that a one-value nonce for a three-item batch does
+  not count towards the threshold — and then that the real nonce replaces it and
+  the batch finishes, so it is a stall rather than damage.
+- **a second proposal under the same id changes nothing.** Every item's seed is
+  already committed to that item's message; a different batch under the same id
+  would have those seeds produce a second partial signature over a second
+  message.
+
+And three in
+[FrostSigningRoundTest](../composeApp/src/commonTest/kotlin/press/mantra/compose/managers/FrostSigningRoundTest.kt),
+against real FROST with no database, for the same reason that file exists at
+all — the library calls are checked with nothing in the way: a `k = 3` batch
+from one signer set where all three verify, an item's signature refusing to
+verify against its neighbour, and both halves of the no-shared-nonce property
+(one seed under two messages gives two nonces, *and* the seeds differ anyway —
+either alone is enough to be relied on by accident).
 
 ---