public wording: fips205 self-test is 18 cases (17 attacks + a digest-coverage check); the post-quantum head signature is 'the second signature', never 'additive' (README, mirror templates, comments); site says leaf 18, not entry 18 (suite 157/0/0)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ESTATE.md

@@ -124,7 +124,7 @@ deployed verifier; see the corpus KNOWN-GAPS ledger).
 | `fips205-source` | upstream | verbatim snapshot of `integritychain/fips205` (pure-Rust FIPS 205 / SLH-DSA); upstream pin `30bac08`, snapshot head `a3ce8e8` — deviations: CI workflows stripped + the documented Aeneas-compat/de-plumbing patch series (each commit individually justified) | pinned; moves only for transparent, individually-justified Aeneas-compat patches (nothing proposed upstream) |
 | `dalek-` / `anza-` / `risc0-` / `betrusted-ed25519-verified` | subject | Rust source + Lean proofs; 44 certs each, attested 44/44 as leaves 13–16 (2026-08-08); earlier 16-cert generations at leaves 8–11, first generations at 0–7 | attested commits fixed |
 | `pasta-pallas-verified` | subject | field foundation proven (sub/neg, helpers, constants, primality, denotation); field completion and curve layer pending; **not attested** | changes freely |
-| `fips205-slhdsa-verified` | subject | SLH-DSA (FIPS 205) verify-path campaign, parameter set SLH-DSA-SHA2-128s; **11 certificates proven, `check.sh` green with an 18-attack self-test**; attested — leaf 18 (2026-08-08), the log's first post-quantum entry | attested commit fixed |
+| `fips205-slhdsa-verified` | subject | SLH-DSA (FIPS 205) verify-path campaign, parameter set SLH-DSA-SHA2-128s; **11 certificates proven, `check.sh` green with an 18-case self-test (17 attacks plus a digest-coverage check)**; attested — leaf 18 (2026-08-08), the log's first post-quantum entry | attested commit fixed |
 | `ltl-accumulator-verified` | subject | 61-cert corpus about the log's accumulator model; **leaf 12 subject**, frozen `172a1d0`; hardened model re-attested as leaf 17 (2026-08-08) | frozen; doc-only commits allowed |
 | `proof-aware-crypto-tooling-agent` (this repo) | machinery | provider service, consumer library, warden (+ local read-only cockpit), dogfood signer, paper, course, tests | **changes freely — the hub** |
 | `lean-transparency-log` | published | the public mirror: leaves, heads, receipts, fail-closed `verify.py` + selftest | **generated by publish** — canonical files here, templates in pacta, CI-pinned |

README.md

@@ -207,7 +207,7 @@ The log uses:
 - `RFC9162_SHA256` Merkle leaf/node hashing with `0x00` leaf and `0x01` node domain separation.
 - Signed Tree Heads over canonical JSON tree-head payloads.
 - OpenSSL Ed25519 signatures today.
-- An additive `SLH-DSA-SHA2-128s` / FIPS 205 slot: verify path proven (fips205-slhdsa-verified, checked by `pacta-verify-slhdsa` built from the pinned proven source); signing deterministic and parameter-locked. Since tree size 14 (2026-08-08) every published head carries this co-signature alongside Ed25519; earlier heads keep their single signature, recorded as absent-not-failed.
+- A second, post-quantum `SLH-DSA-SHA2-128s` / FIPS 205 slot: verify path proven (fips205-slhdsa-verified, checked by `pacta-verify-slhdsa` built from the pinned proven source); signing deterministic and parameter-locked. Since tree size 14 (2026-08-08) every published head carries this co-signature alongside Ed25519; earlier heads keep their single signature, recorded as absent-not-failed.
 - An explicit `ML-DSA-65` / FIPS 204 signature slot that is `unavailable` unless the host has a real backend. If an agent policy requires both signatures, verification fails closed.
 
 The deployed instance ([ltl.zkdefi.org](https://ltl.zkdefi.org),

provider/src/pacta_provider/published_assets.py

@@ -22,8 +22,8 @@ files in this repository alone:
   1. every entry's leaf hash,
   2. every historical Signed Tree Head against the recomputed prefix root
      (a split view or tampered entry fails here),
-  3. every STH Ed25519 signature — and, where a head carries the ADDITIVE
-     SLH-DSA-SHA2-128s signature (FIPS 205, heads from 2026-08 on), that
+  3. every STH Ed25519 signature — and, where a head carries the second,
+     post-quantum SLH-DSA-SHA2-128s signature (FIPS 205, heads from 2026-08 on), that
      too: a present-but-wrong post-quantum signature FAILS the run, a head
      without one is allowed, and an OpenSSL too old to check it (pre-3.5)
      is reported loudly as a degradation, never counted as verified,
@@ -145,12 +145,12 @@ def check_sth_signature(head) -> str:
 
 
 def check_slh_dsa_signature(head):
-    """ADDITIVE post-quantum check (SLH-DSA-SHA2-128s, FIPS 205).
+    """Second-signature (post-quantum) check: SLH-DSA-SHA2-128s, FIPS 205.
 
     Returns (status, hard_failure). Ed25519 remains the REQUIRED signature;
     this one is verified when the head carries it and the local OpenSSL
     (>= 3.5) can check it. The distinctions matter:
-      ABSENT    - head predates the second signature. Allowed: additive.
+      ABSENT    - head predates the second signature. Allowed by design.
       VALID     - verified against provider.slhdsa.pub.
       INVALID   - present and WRONG. Hard failure - a bad signature is never
                   a degradation.
@@ -327,7 +327,7 @@ def main() -> int:
             print(f"STH #{position} size={size} root={head['root_hash'][:16]}… prefix-root:{structural} signature:{signature} slh_dsa:{slh}")
             previous = max(previous, size)
         if slh_tooling_seen:
-            print("NOTE: this log carries an ADDITIVE SLH-DSA (FIPS 205) signature that "
+            print("NOTE: this log carries a second, post-quantum SLH-DSA (FIPS 205) signature that "
                   "your OpenSSL cannot check (needs >= 3.5). The required Ed25519 checks "
                   "above still gate this result; the post-quantum signature was NOT verified.")
         latest_path = HERE / "latest-sth.json"
@@ -439,7 +439,7 @@ def main() -> int:
     cases.append(("--structural-only is explicit, never claims full",
                   code == 0 and "REDUCED" in out and "[full]" not in out))
 
-    # The ADDITIVE post-quantum signature must fail closed when tampered.
+    # The second (post-quantum) signature must fail closed when tampered.
     # Applicable only to mirrors whose heads carry it; older mirrors record
     # the case as not-applicable rather than silently passing.
     latest = json.loads((HERE / "latest-sth.json").read_text())
@@ -522,7 +522,7 @@ Layout:
 | `sth-history.jsonl` | **every** Signed Tree Head ever issued — the witness channel: all cloners see the same heads |
 | `latest-sth.json` | the current head |
 | `provider.ed25519.pub` | the provider's Ed25519 public key — the REQUIRED identity anchor; each statement's truth additionally rests on the assumptions stated in its leaf |
-| `provider.slhdsa.pub` | the provider's SLH-DSA-SHA2-128s public key (FIPS 205) — checks the ADDITIVE post-quantum head signature; needs OpenSSL >= 3.5, and verify.py degrades honestly below that |
+| `provider.slhdsa.pub` | the provider's SLH-DSA-SHA2-128s public key (FIPS 205) — checks the second (post-quantum) head signature; needs OpenSSL >= 3.5, and verify.py degrades honestly below that |
 | `verify.py` | standalone verifier (Python stdlib + the `openssl` binary; fails closed without them; `--all` covers every published receipt) |
 | `verify_selftest.py` | adversarial self-test: proves the verifier's fail-closed paths reject mutated receipts |
 

provider/src/pacta_provider/web.py

@@ -106,7 +106,7 @@ def make_handler(log: TransparencyLog, base_path: str, docs_html: str, paper_pdf
                 # TOFU mitigation depends on the key being published in two
                 # independent locations; this is the site's copy (the mirror
                 # carries the other). Serving only a fingerprint would not do.
-                # The SLH-DSA key (additive post-quantum signature, 2026-08)
+                # The SLH-DSA key (the second, post-quantum signature, 2026-08)
                 # is published THE SAME WAY as the Ed25519 one — same route
                 # shape, same two-location rule.
                 fname = ("provider.ed25519.pub" if route == "/log-public-key"

provider/src/pacta_provider/webdocs.py

@@ -136,7 +136,7 @@ def _trust_anchor_html(log: TransparencyLog, metadata: dict[str, Any], base: str
             f'<a href="{mirror}/blob/main/provider.ed25519.pub">mirror</a> instead.</div>'
         )
     pem = escape(key_path.read_text(encoding="utf-8").strip())
-    # The SLH-DSA verification key (additive post-quantum head signature,
+    # The SLH-DSA verification key (the second, post-quantum head signature,
     # 2026-08) is published THE SAME WAY: full PEM on the page, raw endpoint,
     # mirror comparison. Heads before tree 14 carry no SLH-DSA signature and
     # verify.py reports them ABSENT — allowed; an append-only log keeps its
@@ -150,7 +150,7 @@ def _trust_anchor_html(log: TransparencyLog, metadata: dict[str, Any], base: str
 <p style="margin-top:0"><strong>Key&nbsp;2 — SLH-DSA (FIPS&nbsp;205), post-quantum.</strong> Heads from tree size&nbsp;14 on carry a second signature from this key;
 older heads legitimately have none — an append-only log keeps its history. Check it where your
 tooling allows (OpenSSL&nbsp;≥&nbsp;3.5). The kind of code that verifies such signatures is itself
-a proof subject of this log (entry&nbsp;18).</p>
+a proof subject of this log (leaf&nbsp;18).</p>
 <pre style="margin-bottom:.4rem">{slh_pem}</pre>
 <p class="muted" style="margin:.2rem 0 0">SHA-256 fingerprint <code>{slh_fp}</code>
 &nbsp;·&nbsp; raw: <a href="{base}/log-slhdsa-public-key"><code>{base or ''}/log-slhdsa-public-key</code></a>