Phase 1 of docs/member-archive.md. No wire change, no behaviour change, and one
function where there was one.
`GroupKeyStateEvent.isSignedByGroup` did three things: walk a threshold key to
the room it derives, compare that to the event's author, and check the id and the
signature. Only the first of those needs a key. The other two need the id the
walk produces -- and a room's id *is* that value, held from both ends by
`GroupKeyState.verifies` and `FrostSigningManager.signingPath`.
So the walk splits off and `isSignedByRoom(event, chatRoomId)` is what remains:
the same three checks, with the one input a caller might not have already
resolved. `isSignedByGroup` becomes the one-line caller that walks first, and
every existing call site and test is untouched.
**Why this is worth a commit of its own.** A member added after the ceremony
holds no `DkgSession`, no share, and -- until a state is re-announced, which
nothing does -- no `GroupKeyState` row either. Under the old signature they could
not check a group signature at all, and an archive of the group's work would have
had to be believed because a member said so. Under the new one they check it
against the id in their own Welcome, and the sender of an archive stops needing
to be trusted. That is the property phases 2-9 are built on, so it lands first
and lands alone.
**The catch moved and had to be kept.** `marmotGroupId` is now called outside
`isSignedByRoom`, so `isSignedByGroup` keeps a `runCatching` of its own.
Without it a threshold key that is not a point stops being a refused state and
becomes an exception in the middle of the inbound path -- every input here is off
the wire, and the whole contract of these functions is that malformed means no.
There is a test that fails if the catch is dropped.
**Tests**, added to `GroupKeyStateTest` where the FROST key material, the second
group and the real-quorum `groupSignature` helper already live:
- a room's id is the only key its signature verifies against -- the same group's
sibling room fails, and so does another group entirely;
- the verifier does not care what kind it is looking at, over four kinds
including `GroupKeyStateEvent` itself. That last one is not incidental: a
key state signed by the room passes exactly as a dialect does, which is why
the archive needs an allowlist of kinds on top of this and cannot read "the
group signed it" as permission to apply it;
- a rumor nobody signed is not a group signature -- empty sig, member author,
which is what every nip30303 event on the wire looks like today;
- claiming the room as author proves nothing without the signature. The room id
is in the h tag of every kind:445 the group has sent, so writing it into
`pubKey` is free; the author check and the id check both pass and the signature
is the whole feature;
- an event edited after signing fails on the id, not on the signature -- and the
original still passes, which is why the id check is not redundant;
- malformed input is a no rather than a throw, on both forms.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
bd5e0413f0