teahubxyzandClaude Opus 5.5
00a35613c5
A node's chain key is now its tapkey: its NIP-06 npub with the BIP-86 tweak, so one secret signs its nostr events and its chain spends, and its address follows from its npub. Its leaves hang off the same tree, byte for byte as on lineage's key tree page: an agent's ssh, git, dkim and wg keys from its nostr secret, an org's ssh-ca, mtls and noise keys from its seed. Inspect shows the tapkey, npub, derivation and leaves, with the public lines to paste. Labs keyed by v1.1 keep their separate m/86' chain keys until they are reset. PROVENANCE.md and public/licenses now carry @scure/base, bip32 and bip39, which came in with v1.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh
26 lines
4.8 KiB
Markdown
26 lines
4.8 KiB
Markdown
# Provenance
|
|
|
|
Reviewed 2026-10-04 against the exact upstream revisions below. Upstream repositories were inspected outside this worktree; only the small adaptations identified here were imported. Original adapter/UI code is distinct from the upstream projects and is not endorsed by their authors.
|
|
|
|
| Upstream | Revision | License | Use in v0 |
|
|
| --- | --- | --- | --- |
|
|
| [supertestnet/testnet_generator](https://github.com/supertestnet/testnet_generator/tree/498be4cc775ef18e7ff17357d007918518f47b98) | `498be4cc775ef18e7ff17357d007918518f47b98` | CC0-1.0 | `getVin`/`getVout` object helpers from `index.html` adapted into `src/upstream/primitives.js`; converted to ES exports, explicit scripts, explicit final sequence. Inspiration for browser-owned UTXO chain, immediate 50-coin reward, button mining and integrated explorer. The upstream consensus/Script engine and relay system are **not** imported. |
|
|
| [supertestnet/inscriptions-online](https://github.com/supertestnet/inscriptions-online/tree/470b8bdf29ead319cff9dc119a005cbf58ee598c) | `470b8bdf29ead319cff9dc119a005cbf58ee598c` | CC0-1.0 | `index.html` ord envelope array adapted in `src/adapters/inscription.js`. Modern tapscript API, locally extended with MIME/byte payloads, explicit data-push encoding, 16 KiB cap, tag-3 parent serialization, parent-preserving child reveals and repeated tag-5 CBOR metadata fields. Single commit/reveal, same-wallet destination, no external broadcast or fee services. These extensions and the safe preview UI are original local adapter code. |
|
|
| [supertestnet/vanilla-js-browser-wallet](https://github.com/supertestnet/vanilla-js-browser-wallet/tree/19ae5097f4645bf5b1103a39abc04155a8b072fc) | `19ae5097f4645bf5b1103a39abc04155a8b072fc` | CC0-1.0 | Conceptual inspiration for minimal vanilla-JS wallet and local signing. No copied implementation. |
|
|
| [supertestnet/node_faker](https://github.com/supertestnet/node_faker/tree/2fae6056a7e93322a00a4150468934542ddc937d) | `2fae6056a7e93322a00a4150468934542ddc937d` | CC0-1.0 | Evaluated, **not imported**: its bitcoind-like API obtains data through Electrum connections. That introduces an unnecessary external backend for the self-contained v0. `LocalRPC` is a new, intentionally partial in-process read facade, not a claim of node_faker compatibility. |
|
|
|
|
The upstream CC0 legal text is retained unchanged at [`public/licenses/supertestnet-CC0.txt`](public/licenses/supertestnet-CC0.txt). Source comments identify the exact adapted code and revisions.
|
|
|
|
Runtime dependencies are pinned in `package.json` and `package-lock.json`:
|
|
|
|
- **@cmdcode/tapscript 1.5.3**, Christopher Scott, [upstream](https://github.com/cmdruid/tapscript), CC-BY-1.0. Used for transaction encoding, signing/verification, Taproot commitments and addresses. Installed package license retained unchanged at [`public/licenses/tapscript.txt`](public/licenses/tapscript.txt). Library source is unmodified; Vite bundles/minifies it for the browser.
|
|
- **@noble/curves 1.9.7**, Paul Miller and contributors, [upstream](https://github.com/paulmillr/noble-curves), MIT. Used for key generation/validation and public keys: secp256k1 for chain and nostr keys, Ed25519 and X25519 for lineage's leaves. License retained at [`public/licenses/noble-curves.txt`](public/licenses/noble-curves.txt).
|
|
- **@noble/hashes 1.8.0**, Paul Miller and contributors, [upstream](https://github.com/paulmillr/noble-hashes), MIT. Used for synthetic block hashes, BIP-85's HMAC and the leaves' HKDF-SHA256. License retained at [`public/licenses/noble-hashes.txt`](public/licenses/noble-hashes.txt).
|
|
- **@scure/base 1.2.6**, Paul Miller, [upstream](https://github.com/paulmillr/scure-base), MIT. Used for bech32 npubs and base64 leaf keys. License retained at [`public/licenses/scure-base.txt`](public/licenses/scure-base.txt).
|
|
- **@scure/bip32 1.7.0**, Patricio Palladino and Paul Miller, [upstream](https://github.com/paulmillr/scure-bip32), MIT. Used for HD derivation under the BIP-85, BIP-86 and NIP-06 paths. License retained at [`public/licenses/scure-bip32.txt`](public/licenses/scure-bip32.txt).
|
|
- **@scure/bip39 1.6.0**, Patricio Palladino and Paul Miller, [upstream](https://github.com/paulmillr/scure-bip39), MIT. Used for the 24-word lab roots and their seeds. License retained at [`public/licenses/scure-bip39.txt`](public/licenses/scure-bip39.txt).
|
|
|
|
Vite and Playwright are build/test dependencies, not runtime network services. Their installed package notices remain in the locked dependency installation. No unlicensed upstream code was copied.
|
|
|
|
The bounded JSON/CBOR codec, byte-derived MetadataIndex, trusted event-counter reducer, local API facade and persisted auto-miner schedule are original adapter code. Metadata encoding and endpoint naming were checked against the [Ordinals metadata](https://docs.ordinals.com/inscriptions/metadata.html) and [endpoint](https://docs.ordinals.com/inscriptions/recursion.html) references; no ord source code was copied.
|