Orgchain v1.10: keyrings, each key signing in its own chain's standard

A new lineage/v0 op binds a node's keys in one inscription whose parent is the
node itself: its Taproot and SegWit addresses, its npub and its Ethereum
address. Every key signs the same statement the way its own wallets sign a
message: BIP-322 simple signatures for the Bitcoin addresses, a NIP-01 note
(kind 1, created_at 0) for the npub, EIP-191 for Ethereum. The reducer checks
every proof, binds a standing keyring's keys to its node, lets the newest
keyring replace the older, and retires keyrings at a graduation (the keys
change with the new root) and at a close.

Every account gets an Ethereum key at m/44'/60'/account'/0/0; an org's, at
account 0, is the key tree page's legal-control key and matches its published
vector. Keyring is the ninth verb; Inspect shows each node's keyring and the
statement its keys signed, and Reveal its Ethereum private key. The sample
publishes three keyrings, and lineage's retires when it graduates.

Tests pin BIP-322's published vectors and values cross-checked with
bip322-js, ethers and nostr-tools. The regtest rehearsal, rerun with five
keyrings, confirmed 89 transactions on Bitcoin Core; ord's 26 events fold to
the same trees and keyrings, every proof checked from ord's copy, and the
fixture is re-recorded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh

PROVENANCE.md

@@ -14,14 +14,16 @@ The upstream CC0 legal text is retained unchanged at [`public/licenses/supertest
 Runtime dependencies are pinned in `package.json` and `package-lock.json`:
 
 - **@cmdcode/tapscript 1.5.3**, Christopher Scott, [upstream](https://github.com/cmdruid/tapscript), CC-BY-1.0. Used for transaction encoding, signing/verification, Taproot commitments and addresses, and the BIP-143 digests and signatures of SegWit payments. Installed package license retained unchanged at [`public/licenses/tapscript.txt`](public/licenses/tapscript.txt). Library source is unmodified; Vite bundles/minifies it for the browser.
-- **@noble/curves 1.9.7**, Paul Miller and contributors, [upstream](https://github.com/paulmillr/noble-curves), MIT. Used for key generation/validation and public keys, and to verify the low-S DER signatures of SegWit payments: secp256k1 for chain and nostr keys, Ed25519 and X25519 for lineage's leaves. License retained at [`public/licenses/noble-curves.txt`](public/licenses/noble-curves.txt).
-- **@noble/hashes 1.8.0**, Paul Miller and contributors, [upstream](https://github.com/paulmillr/noble-hashes), MIT. Used for synthetic block hashes, BIP-85's HMAC, the leaves' HKDF-SHA256 and the RIPEMD-160 of P2WPKH key hashes. License retained at [`public/licenses/noble-hashes.txt`](public/licenses/noble-hashes.txt).
-- **@scure/base 1.2.6**, Paul Miller, [upstream](https://github.com/paulmillr/scure-base), MIT. Used for bech32 npubs and base64 leaf keys. License retained at [`public/licenses/scure-base.txt`](public/licenses/scure-base.txt).
-- **@scure/bip32 1.7.0**, Patricio Palladino and Paul Miller, [upstream](https://github.com/paulmillr/scure-bip32), MIT. Used for HD derivation under the BIP-85, BIP-86, BIP-84 and NIP-06 paths. License retained at [`public/licenses/scure-bip32.txt`](public/licenses/scure-bip32.txt).
+- **@noble/curves 1.9.7**, Paul Miller and contributors, [upstream](https://github.com/paulmillr/noble-curves), MIT. Used for key generation/validation and public keys, to verify the low-S DER signatures of SegWit payments, and to make and check keyrings' proofs (BIP-340, low-S ECDSA, and the public-key recovery EIP-191 relies on): secp256k1 for chain, nostr and Ethereum keys, Ed25519 and X25519 for lineage's leaves. License retained at [`public/licenses/noble-curves.txt`](public/licenses/noble-curves.txt).
+- **@noble/hashes 1.8.0**, Paul Miller and contributors, [upstream](https://github.com/paulmillr/noble-hashes), MIT. Used for synthetic block hashes, BIP-85's HMAC, the leaves' HKDF-SHA256, the RIPEMD-160 of P2WPKH key hashes, the tagged hashes of BIP-322, and the Keccak-256 of Ethereum addresses (EIP-55) and EIP-191. License retained at [`public/licenses/noble-hashes.txt`](public/licenses/noble-hashes.txt).
+- **@scure/base 1.2.6**, Paul Miller, [upstream](https://github.com/paulmillr/scure-base), MIT. Used for bech32 npubs, base64 leaf keys, and the bech32 and bech32m addresses and base64 BIP-322 signatures in keyrings. License retained at [`public/licenses/scure-base.txt`](public/licenses/scure-base.txt).
+- **@scure/bip32 1.7.0**, Patricio Palladino and Paul Miller, [upstream](https://github.com/paulmillr/scure-bip32), MIT. Used for HD derivation under the BIP-85, BIP-86, BIP-84, NIP-06 and BIP-44 Ethereum paths. License retained at [`public/licenses/scure-bip32.txt`](public/licenses/scure-bip32.txt).
 - **@scure/bip39 1.6.0**, Patricio Palladino and Paul Miller, [upstream](https://github.com/paulmillr/scure-bip39), MIT. Used for the 24-word lab roots and their seeds. License retained at [`public/licenses/scure-bip39.txt`](public/licenses/scure-bip39.txt).
 
 Five local changes to the engine, all original code in `src/adapters/chain.js`, tested in `tests/money.test.js`, with Super Testnet's tests (`tests/adapters.test.js`) passing unchanged. Orgchain v1.5: the chain also accepts native SegWit (P2WPKH) outputs and SIGHASH_ALL P2WPKH spends, verified per BIP-143, so lineage accounts can hold and send test BTC at their BIP-84 addresses; everything about inscriptions stays Taproot-only. Orgchain v1.6: a coinbase may split the block reward across up to 64 outputs (`mineTo`; `mine` still pays one script), so one beat can pay several holdings. Orgchain v1.7: ordinary (non-reveal) spends may take up to eight inputs and outputs (`MAX_IO`), and their key-path Taproot signatures may carry SIGHASH_SINGLE|ANYONECANPAY (0x83, the sell-order flag), so one transaction can carry a deal: an item, the buyer's coins, the price and change. Reveals keep their two-in, two-out shape and default signatures. Orgchain v1.9: a chain may start from coins imported from a real chain (`importCoin`; `MetadataIndex` numbers their sats the same way, `importRanges` in `src/adapters/sats.js`), so the regtest rehearsal can broadcast the lab's transactions byte for byte; and a reveal's script path is checked per BIP-341 and BIP-342 against the exact script bytes (`tapscriptValid`), with tapscript's own check kept as a fallback so labs saved earlier still load. That rehearsal also found that the inscription adapter (`src/adapters/inscription.js`, adapted from inscriptions-online) committed its reveals to tapscript's `encodeScript` of a hex script, which re-encodes one-byte pushes, so real Bitcoin rejected them; it now commits to the exact bytes (`tapleafOf`). Tested in `tests/indexer.test.js`.
 
+Keyrings (`src/orgchain/keyring.js`, original code) sign with each chain's own message standard: BIP-322 simple signatures, EIP-191 `personal_sign`, and a NIP-01 event. `tests/keyring.test.js` pins BIP-322's published vectors, and values that bip322-js 3.0.0, ethers 6 and nostr-tools 2 produced or accepted in a one-time cross-check; none of those is a dependency.
+
 Vite and Playwright are build/test dependencies, not runtime network services. Their installed package notices remain in the locked dependency installation. No unlicensed upstream code was copied.
 
 The bounded JSON/CBOR codec, byte-derived MetadataIndex, trusted event-counter reducer, local API facade and persisted auto-miner schedule are original adapter code. Metadata encoding and endpoint naming were checked against the [Ordinals metadata](https://docs.ordinals.com/inscriptions/metadata.html) and [endpoint](https://docs.ordinals.com/inscriptions/recursion.html) references; no ord source code was copied.