[A-EDev]

Summary

Every Ed25519 key and signature must now hold points of order exactly L, as flow-sync #101 specifies, so all Flow implementations give one answer for one signature.

• is_valid_signing_key also checks that the key is torsion free. verify already calls it first, so the check runs when a key enters the roster and again on every signature. verify_strict then settles R: it refuses small order, compares the canonical encoding, and with a torsion-free key its equation can only hold for an R of order L.
• No new dependency: VerifyingKey::to_edwards returns the point, and is_torsion_free is its method. Cargo.toml and Cargo.lock are unchanged.
• Every device replays its roster through apply_entry, so the check also runs on stored entries. A chain that holds such a key stops at that entry with roster-key, on every device, as the spec's design expects. Honest clients never write one.
• Paths checked by reading: genesis, add, restore and recovery subjects all go through check_subject. A restore's signer, log objects, live messages and LAN hellos all use keys from the roster state, and all go through verify. A pairing's Join key becomes an add entry that apply_entry checks before it is appended. No path was found that verifies with an unchecked key.
• Vectors from flow-sync 01050b2, byte for byte. The fixtures README is that commit's whole file, which also brings its pairing line up to date.

Follows flow-sync #101.

Related issue

None.

Change type

• Feature

Validation

Run on macOS arm64.

• pnpm test: not run, no frontend file changed
• pnpm build: not run, no frontend file changed
• cargo fmt --manifest-path src-tauri/Cargo.toml --all -- --check: exit 0
• cargo clippy --all-targets --all-features in src-tauri: exit 0, no warnings from this change; one existing warning at roster.rs:378 on a line it doesn't touch
• cargo test --no-fail-fast --all-targets --all-features in src-tauri: 1286 passed, 0 failed, 9 ignored
• I smoke-tested the affected desktop behavior. Nothing ran in a real window.

Before the change, ed25519_strict_verification failed on mixed-order-key-both-equations and the roster negatives failed on mixed-order-key.

Checked by breaking the code on purpose, one change at a time, with sync2_vectors and sync2_roster:

Change	Tests that failed
The key check drops the order test	3
The key check drops the small-order test	2
verify skips the key check	1
verify isn't strict	2
A roster key isn't checked	2

Risk and compatibility

• No format or database change.

• verify takes longer: in the unoptimized test build, the key check is about 160 µs of a 430 µs verification. The release build wasn't measured.

• Not run against Android or a server under this rule.

• This file set overlaps other open PRs on roster.json, the fixtures README and the changelog, so whichever lands later takes the fixtures again.

• No new secrets, private data, telemetry, or broad Tauri permissions were introduced.

• User-facing documentation was updated where needed. (spec/crypto.md in flow-sync fix(dearrow): strip case-preservation markers from titles #101)

• Dependency and lockfile changes are intentional and limited to this PR. (none)

• Breaking changes and upgrade steps are clearly documented. (none for honest clients)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.