v0.6.3 — delegated proving, Phase 2 (split authorisation; chain 17)

v0.6.3 — delegated proving, Phase 2: split authorisation

A bundle proof no longer takes the spend key. On a chain whose genesis names the v3 bundle guest and the auth guest, a transfer carries two proofs: the bundle proof over the viewing key's nk and a fresh per-transaction salt, publishing c = H(AUTH, nk, salt) inside its digest, and a small auth proof the wallet always makes itself (tier 10, ~7 s, ~1.37 MB) over the spend key and the same salt, proved against the same transaction binding. A paired prover — anyone's — can therefore make the bundle proof without being able to spend; it learns the wallet's history, never its key.

This is a hard fork. v0.6.3 runs chain 17 only. Bundle gains auth_commit and auth_proof on the wire and the transaction id domain is rand-txid-3, so this build decodes none of chain 16's bundles and refuses to start on chains 14, 15 and 16 (their genesis hashes are pinned). Do NOT roll it onto the chain-16 fleet; it lands with the chain-17 cut (deploy/cut-chain17-genesis.sh, deploy/cutover-fleet-chain17.sh).

• Guests (crates/randprotocol-zkvm, node-local): the auth guest (hc_auth 1e4e347f…39c1) and bundle guest v3 (hc_bundle 60af094a…3fce, tier 14, v2 + 87 cycles); v1/v2 chains are byte-identical. A six-case cheating suite with real proofs.
• Consensus rules (genesis hc_auth, hashed after hardening_v6): auth_commit must equal the auth proof's published c, the bundle digest binds it, both proofs verify against the binding; TxError::{AuthUnexpected, AuthMissing, AuthMismatch, InvalidAuthProof} are permanent refusals. Pre-v3 chains require zero auth_commit and an empty auth_proof.
• rand-node genesis --bundle-guest v3 --auth-guest (both or neither); a v3 genesis must leave block room for three proofs (bundle, auth, call): max_block_bytes ≥ 3·max_proof_bytes + 1 MiB, refused otherwise — chain 17 is cut with 4 MiB proofs and 20 MiB blocks; rand_status / rand_getLimits serve hc_auth; tx_json shows auth_commit and auth_proof_bytes.
• rand-prover accepts viewing_key jobs for the v3 guest from any pairing (prover_info.witness_kinds); the prover fee: run --fee <RAND> --fee-address <rand1…>, quoted in prover_info.fee, checked as one RAND output inside the witness (-32006 when missing).
• Wallet: on a v3 chain rand send makes the auth proof locally and the bundle proof locally or through --prover as a viewing-key job (a non-own pairing prints "this prover can read this wallet's whole history; it cannot spend" once); refuses before proving if the chain's hc_auth is not this build's. Pre-v3 chains send exactly as v0.6.2. A quoted prover fee above --max-prover-fee (default 1 RAND) is refused before anything is built, on every --prover command.

Docs: docs/prover.md, docs/shielded.md, docs/confidential.md, docs/rpc.md (changelog v0.6.3). Companion: randscan reads auth_commit through tx_json; the clients re-vendor at this tag (clients Phase 2).

Build: rand-node, rand, rand-prover built on Linux from this tag; SHA256SUMS attached — check it before installing.