counter-sign 0.1.3

counter-sign 0.1.3 — security hardening

Supersedes v0.1.2, which contains an authorization-bypass BLOCKER. Upgrade.

Hardened through two adversarial reviews before going public: a five-front internal red-team, then an independent second-engine pass (OpenAI Codex, adversarial), re-reviewed until it returned approve — "no confirmed material authorization or timeout bypass remains." The cryptographic core held throughout; every fix ships with a regression test (120 total).

Fixed

• BLOCKER — authorization bypass. verifyResolution gated its quorum check on the attacker-supplied resolution.policy; a policy:"default" approve with a single authority-signed receipt authorized any quorum-N Intent (ran a 3-of-3 deploy with 0 human approvals). Now enforced for every approve; each receipt's decision must match.
• Named approvers are enforced — an unlisted channel member's click is ignored (membership is not authority), at both settle and verifyResolution.
• Timeout correctness — the deadline is enforced in awaitWithDefault (and settle), so a late decision after an event-loop stall can't beat the signed Default; the reaper no longer breaks the arbitration.
• Webhooks fail closed — WHATSAPP_APP_SECRET and TELEGRAM_WEBHOOK_SECRET required (constant-time); Telegram keys on the stable numeric id; oversized bodies are caught.
• DoS — readBody size-capped; PendingDecisions reaps at the deadline; Intent invariants re-validated; quorumOf fails closed.
• LocalAdapter refuses quorum > 1 (one terminal can't authenticate distinct humans) — like EmailAdapter.

Corrected claims (now accurate)

• ReceiptLog is tamper-evident only against an externally-anchored head() (the keyless chain can be re-forged by a writer).
• Quorum four-eyes is authority-enforced, not cryptographic separation of duty.
  Per-approver keys and a keyed self-anchoring log are v0.2.

No wire-format change — v0.1.x receipts still verify. Full detail: docs/security-review.md (CS-01 … CS-19).