Phase B: identifier+key on the wire, JCS envelope signing (FRX/0.5), registry binding

src/crypto.rs

@@ -121,20 +121,19 @@ pub fn verify_signature(public_hex: &str, message: &[u8], sig_hex: &str) -> Resu
 }
 
 pub fn signing_bytes(envelope: &Envelope) -> Vec<u8> {
-    format!(
-        "{}\n{}\n{}\n{}\n{}\n{}",
-        PROTOCOL,
-        envelope.msg_type,
-        envelope.from,
-        envelope.ts,
-        envelope.nonce,
-        canonical_json(&envelope.body)
-    )
-    .into_bytes()
+    let unsigned = serde_json::json!({
+        "type": envelope.msg_type,
+        "from": envelope.from,
+        "key": envelope.key,
+        "ts": envelope.ts,
+        "nonce": envelope.nonce,
+        "body": envelope.body,
+    });
+    format!("{}\n{}", PROTOCOL, canonical_json(&unsigned)).into_bytes()
 }
 
 pub fn verify_envelope(envelope: &Envelope) -> Result<()> {
-    verify_signature(&envelope.from, &signing_bytes(envelope), &envelope.sig)
+    verify_signature(&envelope.key, &signing_bytes(envelope), &envelope.sig)
 }
 
 pub fn now_ts() -> u64 {
@@ -160,14 +159,24 @@ mod tests {
     #[test]
     fn envelope_sign_verify_roundtrip() {
         let key = Keypair::generate();
-        let env = Envelope::new(&key, crate::message::TYPE_QUERY, json!({"text": "hello"}));
+        let env = Envelope::new(
+            &key,
+            "alice.example",
+            crate::message::TYPE_QUERY,
+            json!({"text": "hello"}),
+        );
         verify_envelope(&env).unwrap();
     }
 
     #[test]
     fn tampered_body_fails_verification() {
         let key = Keypair::generate();
-        let mut env = Envelope::new(&key, crate::message::TYPE_QUERY, json!({"text": "hello"}));
+        let mut env = Envelope::new(
+            &key,
+            "alice.example",
+            crate::message::TYPE_QUERY,
+            json!({"text": "hello"}),
+        );
         env.body = json!({"text": "hello", "extra": true});
         assert!(verify_envelope(&env).is_err());
     }