v0.1.19 - Added --register-role CLI flag for non-interactive template-role registration; expanded CLI test suite with template-role distinct-pubkey, path-rejection, ml-dsa-65 and slh-dsa-128s sign/verify tests (45 pass, 0 fail)

src/main.c

@@ -813,8 +813,8 @@ int socket_name_random(char *out, size_t out_len);
 /* Version information (auto-updated by build/version tooling) */
 #define NSIGNER_VERSION_MAJOR 0
 #define NSIGNER_VERSION_MINOR 1
-#define NSIGNER_VERSION_PATCH 18
+#define NSIGNER_VERSION_PATCH 19
-#define NSIGNER_VERSION "v0.1.18"
+#define NSIGNER_VERSION "v0.1.19"
 
 
 /* NSIGNER_HEADERLESS_DECLS_END */
@@ -1349,7 +1349,8 @@ static void print_usage(const char *program_name) {
     tui_print("nsigner - single-binary signer program");
     tui_print("Usage:");
     tui_print("  %s [--socket-name|--name|-n <name>] [--listen|-l <unix|stdio|qrexec|tcp:HOST:PORT>]", program_name);
-    tui_print("                                           [--preapprove|-p <SPEC>]... [--auth|-a <off|optional|required>]");
+    tui_print("                                           [--preapprove|-p <SPEC>]... [--register-role <SPEC>]...");
+    tui_print("                                           [--auth|-a <off|optional|required>]");
     tui_print("                                           [--mnemonic-stdin|--mnemonic-fd <N>] [--allow-all|-A]");
     tui_print("                                           [--bridge-source-trusted]");
     tui_print("                                           Run signer server (unix mode has TUI)");
@@ -1365,6 +1366,11 @@ static void print_usage(const char *program_name) {
     tui_print("  --preapprove, -p SPEC");
     tui_print("                      Pre-approve a caller for a role (repeatable)");
     tui_print("                      SPEC: caller=<id>,role=<name> or caller=<id>,nostr_index=<n>");
+    tui_print("  --register-role SPEC");
+    tui_print("                      Register a named path-role non-interactively (repeatable)");
+    tui_print("                      SPEC: <name>:<curve>:<path-template>");
+    tui_print("                      e.g. nostr_range:secp256k1:m/44'/1237'/*'/0/0");
+    tui_print("                      Suppresses the default 'main' role in non-TTY mode");
     tui_print("  --auth, -a MODE     Auth envelope policy per listener: off|optional|required");
     tui_print("  --mnemonic-stdin    Read mnemonic from stdin (one line) at startup");
     tui_print("  --mnemonic-fd N     Read mnemonic from inherited fd N (one line) at startup");
@@ -2667,6 +2673,145 @@ static role_purpose_t purpose_from_path(const char *path) {
     return PURPOSE_NOSTR;  /* default */
 }
 
+/*
+ * Parse a --register-role spec of the form:
+ *   <name>:<curve>:<path-template>
+ * and register it into the role table. The curve field may be empty
+ * (e.g. "name::path") in which case the curve is auto-detected from the
+ * path prefix via purpose_from_path + the default curve for that purpose.
+ *
+ * The path-template uses the same syntax as the TUI wizard:
+ *   - Wildcard:  * or *'  (any non-negative integer)
+ *   - Range:     0-99 or 0-99'  (inclusive range)
+ *   - Set:       1+3+5 or 1+3-5+10
+ *   - Fixed:     a literal path with no variable segment
+ *
+ * Returns 0 on success, -1 on parse error.
+ */
+static int register_role_from_spec(role_table_t *role_table, const char *spec) {
+    char buf[512];
+    char *name, *curve_str, *path_token;
+    role_curve_t curve;
+    role_purpose_t purpose;
+    char template[ROLE_PATH_MAX];
+    int range_lo, range_hi;
+    int allowed_indices[64];
+    int allowed_count = 0;
+    role_entry_t new_role;
+
+    if (role_table == NULL || spec == NULL) {
+        return -1;
+    }
+
+    strncpy(buf, spec, sizeof(buf) - 1);
+    buf[sizeof(buf) - 1] = '\0';
+
+    /* Split on ':' — name:curve:path-template */
+    name = buf;
+    curve_str = strchr(buf, ':');
+    if (curve_str == NULL) {
+        fprintf(stderr, "--register-role: missing ':' separator in '%s'\n", spec);
+        return -1;
+    }
+    *curve_str = '\0';
+    curve_str++;
+    path_token = strchr(curve_str, ':');
+    if (path_token == NULL) {
+        fprintf(stderr, "--register-role: missing path template in '%s' (expected name:curve:path)\n", spec);
+        return -1;
+    }
+    *path_token = '\0';
+    path_token++;
+
+    if (name[0] == '\0') {
+        fprintf(stderr, "--register-role: empty role name in '%s'\n", spec);
+        return -1;
+    }
+    if (path_token[0] == '\0') {
+        fprintf(stderr, "--register-role: empty path template in '%s'\n", spec);
+        return -1;
+    }
+
+    /* Resolve curve: empty string → auto-detect from path */
+    if (curve_str[0] == '\0') {
+        purpose = purpose_from_path(path_token);
+        /* Default curve per purpose */
+        switch (purpose) {
+            case PURPOSE_SSH:      curve = CURVE_ED25519; break;
+            case PURPOSE_AGE:      curve = CURVE_X25519; break;
+            case PURPOSE_PQ_SIG:
+                /* 102003 → ml-dsa-65, 102004 → slh-dsa-128s */
+                if (strncmp(path_token, "m/44'/102004'", 13) == 0) {
+                    curve = CURVE_SLH_DSA_128S;
+                } else {
+                    curve = CURVE_ML_DSA_65;
+                }
+                break;
+            case PURPOSE_PQ_KEM:   curve = CURVE_ML_KEM_768; break;
+            default:               curve = CURVE_SECP256K1; break;
+        }
+    } else {
+        curve = role_curve_from_str(curve_str);
+        if (curve == CURVE_UNKNOWN) {
+            fprintf(stderr, "--register-role: unknown curve '%s' in '%s'\n", curve_str, spec);
+            return -1;
+        }
+        purpose = purpose_from_path(path_token);
+    }
+
+    /* Parse the path template (wildcard/range/set → %d) */
+    if (parse_path_template_for_role(path_token, template, sizeof(template),
+                                      &range_lo, &range_hi,
+                                      allowed_indices, 64, &allowed_count) != 0) {
+        fprintf(stderr, "--register-role: invalid path template '%s'\n", path_token);
+        return -1;
+    }
+
+    /* Validate purpose+curve combination */
+    if (crypto_alg_from_role(curve, purpose) == CRYPTO_ALG_UNKNOWN) {
+        fprintf(stderr, "--register-role: curve '%s' is not valid for path '%s'\n",
+                role_curve_to_str(curve), path_token);
+        return -1;
+    }
+
+    /* Register the role (no approval required in non-interactive mode) */
+    memset(&new_role, 0, sizeof(new_role));
+    strncpy(new_role.name, name, sizeof(new_role.name) - 1);
+    new_role.name[sizeof(new_role.name) - 1] = '\0';
+    strncpy(new_role.purpose_str, role_purpose_to_str(purpose), sizeof(new_role.purpose_str) - 1);
+    new_role.purpose_str[sizeof(new_role.purpose_str) - 1] = '\0';
+    strncpy(new_role.curve_str, role_curve_to_str(curve), sizeof(new_role.curve_str) - 1);
+    new_role.curve_str[sizeof(new_role.curve_str) - 1] = '\0';
+    new_role.purpose = purpose;
+    new_role.curve = curve;
+    new_role.selector_type = SELECTOR_ROLE_PATH;
+    strncpy(new_role.role_path, template, sizeof(new_role.role_path) - 1);
+    new_role.role_path[sizeof(new_role.role_path) - 1] = '\0';
+    new_role.nostr_index = -1;
+    new_role.path_range_lo = range_lo;
+    new_role.path_range_hi = range_hi;
+    new_role.path_default_index = -1;
+    new_role.requires_approval = 0;  /* non-interactive: no TUI approval */
+    if (allowed_count > 0) {
+        int copy_n = allowed_count;
+        if (copy_n > (int)(sizeof(new_role.path_allowed_indices) / sizeof(new_role.path_allowed_indices[0]))) {
+            copy_n = (int)(sizeof(new_role.path_allowed_indices) / sizeof(new_role.path_allowed_indices[0]));
+        }
+        memcpy(new_role.path_allowed_indices, allowed_indices, (size_t)copy_n * sizeof(int));
+        new_role.path_allowed_count = copy_n;
+    } else {
+        new_role.path_allowed_count = 0;
+    }
+    new_role.derived = 0;
+
+    if (role_table_add(role_table, &new_role) != 0) {
+        fprintf(stderr, "--register-role: failed to register role '%s' (table full or duplicate name)\n", name);
+        return -1;
+    }
+
+    return 0;
+}
+
 
 static int prompt_load_mnemonic_tui(mnemonic_state_t *mnemonic) {
     char phrase[MNEMONIC_MAX_LEN];
@@ -3405,6 +3550,8 @@ int main(int argc, char *argv[]) {
     int argi = 1;
     const char *preapprove_specs[POLICY_MAX_ENTRIES];
     int preapprove_count = 0;
+    const char *register_role_specs[ROLE_TABLE_MAX_ENTRIES];
+    int register_role_count = 0;
     int auth_mode = NSIGNER_AUTH_OFF;
     int auth_skew_seconds = AUTH_DEFAULT_SKEW_SECONDS;
     int allow_all = 0;
@@ -3483,6 +3630,19 @@ int main(int argc, char *argv[]) {
             argi += 2;
             continue;
         }
+        if (strcmp(argv[argi], "--register-role") == 0) {
+            if (argi + 1 >= argc) {
+                fprintf(stderr, "Missing value for %s\n", argv[argi]);
+                return 1;
+            }
+            if (register_role_count >= ROLE_TABLE_MAX_ENTRIES) {
+                fprintf(stderr, "Too many --register-role entries (max %d)\n", ROLE_TABLE_MAX_ENTRIES);
+                return 1;
+            }
+            register_role_specs[register_role_count++] = argv[argi + 1];
+            argi += 2;
+            continue;
+        }
         if (strcmp(argv[argi], "--mnemonic-stdin") == 0) {
             if (mnemonic_source.kind != MNEMONIC_SOURCE_TUI) {
                 fprintf(stderr, "nsigner: --mnemonic-stdin and --mnemonic-fd are mutually exclusive\n");
@@ -3626,7 +3786,19 @@ int main(int argc, char *argv[]) {
             return 1;
         }
     } else {
-        /* Non-interactive mode: create a default "main" role */
+        /* Non-interactive mode. If --register-role specs were provided,
+         * register those roles (suppressing the default "main" role).
+         * Otherwise, create a default "main" role with the standard
+         * NIP-06 path. */
+        if (register_role_count > 0) {
+            for (int i = 0; i < register_role_count; ++i) {
+                if (register_role_from_spec(&role_table, register_role_specs[i]) != 0) {
+                    fprintf(stderr, "Failed to register role from --register-role spec\n");
+                    mnemonic_unload(&mnemonic);
+                    return 1;
+                }
+            }
+        } else {
             role_entry_t role;
             memset(&role, 0, sizeof(role));
             strncpy(role.name, "main", sizeof(role.name) - 1);
@@ -3649,6 +3821,7 @@ int main(int argc, char *argv[]) {
                 return 1;
             }
         }
+    }
 
     memset(&key_store, 0, sizeof(key_store));
     alg_key_cache_init(&alg_key_cache);

tests/test_n_signer_client.sh

@@ -206,8 +206,55 @@ stop_server() {
     fi
 }
 
+# Second server with --register-role (template roles). Uses a separate socket.
+REGROLE_SOCKET_NAME=""
+REGROLE_SERVER_PID=""
+
+start_server_regrole() {
+    REGROLE_SOCKET_NAME="nsigner_test_regrole_$$"
+    echo "Starting nsigner server with --register-role (socket: @$REGROLE_SOCKET_NAME)..."
+
+    export NSIGNER_TEST_NONINTERACTIVE_PROMPT=allow
+    echo "$MNEMONIC" | "$SERVER" \
+        --socket-name "$REGROLE_SOCKET_NAME" \
+        --allow-all \
+        --listen unix \
+        --mnemonic-stdin \
+        --register-role "nostr_range:secp256k1:m/44'/1237'/*'/0/0" \
+        --register-role "ssh_range:ed25519:m/44'/102001'/*'/0'/0'" \
+        --register-role "ml_dsa_range:ml-dsa-65:m/44'/102003'/*'/0'/0'" \
+        --register-role "slh_dsa_range:slh-dsa-128s:m/44'/102004'/*'/0'/0'" \
+        >/dev/null 2>&1 &
+    REGROLE_SERVER_PID=$!
+
+    local max_attempts=50
+    local attempt=0
+    while [ $attempt -lt $max_attempts ]; do
+        if grep -q "$REGROLE_SOCKET_NAME" /proc/net/unix 2>/dev/null; then
+            echo "Regrole server ready (PID $REGROLE_SERVER_PID, socket @$REGROLE_SOCKET_NAME)"
+            return 0
+        fi
+        sleep 0.1
+        attempt=$((attempt + 1))
+    done
+    echo "ERROR: regrole server did not become ready"
+    kill "$REGROLE_SERVER_PID" 2>/dev/null
+    REGROLE_SERVER_PID=""
+    return 1
+}
+
+stop_server_regrole() {
+    if [ -n "$REGROLE_SERVER_PID" ]; then
+        echo "Stopping regrole server (PID $REGROLE_SERVER_PID)..."
+        kill "$REGROLE_SERVER_PID" 2>/dev/null
+        wait "$REGROLE_SERVER_PID" 2>/dev/null || true
+        REGROLE_SERVER_PID=""
+    fi
+}
+
 cleanup() {
     stop_server
+    stop_server_regrole
 }
 
 # ---------------------------------------------------------------------------
@@ -589,6 +636,243 @@ test_ml_kem_roundtrip() {
     fi
 }
 
+# ---------------------------------------------------------------------------
+#  Template-role tests (require the regrole server with --register-role)
+# ---------------------------------------------------------------------------
+test_template_role_distinct_pubkeys() {
+    echo ""
+    echo "=== Template-role: distinct pubkeys per account index ==="
+
+    # This test catches the caching bug where a template role returned the
+    # same pubkey for all concrete paths after the first derivation.
+    local name="nostr_range index 0 returns 64 hex"
+    local pk0
+    pk0=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/0'/0/0" get-public-key 2>/dev/null) || {
+        fail "$name" "exit code $?"
+        return
+    }
+    if printf '%s\n' "$pk0" | grep -qE '^[0-9a-f]{64}$'; then
+        pass "$name"
+    else
+        fail "$name" "got: $pk0"
+        return
+    fi
+
+    local pk1 pk5
+    pk1=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/1'/0/0" get-public-key 2>/dev/null)
+    pk5=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/5'/0/0" get-public-key 2>/dev/null)
+
+    if [ "$pk0" != "$pk1" ]; then
+        pass "nostr_range index 0 != index 1 (distinct keys)"
+    else
+        fail "nostr_range index 0 != index 1 (distinct keys)" "both: $pk0"
+    fi
+
+    if [ "$pk0" != "$pk5" ] && [ "$pk1" != "$pk5" ]; then
+        pass "nostr_range index 5 distinct from 0 and 1"
+    else
+        fail "nostr_range index 5 distinct from 0 and 1" "pk0=$pk0 pk1=$pk1 pk5=$pk5"
+    fi
+
+    # Re-request index 0 to confirm it's stable (not affected by caching)
+    local pk0_again
+    pk0_again=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/0'/0/0" get-public-key 2>/dev/null)
+    if [ "$pk0" = "$pk0_again" ]; then
+        pass "nostr_range index 0 stable on re-request"
+    else
+        fail "nostr_range index 0 stable on re-request" "first=$pk0 second=$pk0_again"
+    fi
+}
+
+test_template_role_path_rejection() {
+    echo ""
+    echo "=== Template-role: path validation rejection ==="
+
+    # Hardened tail should be rejected (role template has unhardened 0/0)
+    local name="reject hardened tail (0'/0') with path_not_allowed"
+    local output rc
+    set +e
+    output=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/0'/0'/0'" get-public-key 2>&1)
+    rc=$?
+    set -e
+    if [ $rc -ne 0 ] && printf '%s\n' "$output" | grep -q 'path_not_allowed'; then
+        pass "$name"
+    else
+        fail "$name" "rc=$rc output=$output"
+    fi
+
+    # Wrong change segment should be rejected
+    name="reject wrong change segment (1) with path_not_allowed"
+    set +e
+    output=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/0'/1/0" get-public-key 2>&1)
+    rc=$?
+    set -e
+    if [ $rc -ne 0 ] && printf '%s\n' "$output" | grep -q 'path_not_allowed'; then
+        pass "$name"
+    else
+        fail "$name" "rc=$rc output=$output"
+    fi
+
+    # Unknown role should be rejected
+    name="reject unknown role with unknown_role"
+    set +e
+    output=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role bogus --path "m/44'/1237'/0'/0/0" get-public-key 2>&1)
+    rc=$?
+    set -e
+    if [ $rc -ne 0 ] && printf '%s\n' "$output" | grep -q 'unknown_role'; then
+        pass "$name"
+    else
+        fail "$name" "rc=$rc output=$output"
+    fi
+}
+
+test_template_role_sign_event() {
+    echo ""
+    echo "=== Template-role: sign-event with distinct indices ==="
+
+    local pk0 signed_pubkey
+    pk0=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/0'/0/0" get-public-key 2>/dev/null)
+
+    local name="sign-event via nostr_range index 0"
+    local output
+    output=$(echo "$EVENT_JSON" | $CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/0'/0/0" sign-event 2>/dev/null) || {
+        fail "$name" "exit code $?"
+        return
+    }
+    signed_pubkey=$(json_get "pubkey" "$output")
+    if [ "$signed_pubkey" = "$pk0" ]; then
+        pass "$name pubkey matches get-public-key"
+    else
+        fail "$name pubkey matches get-public-key" "expected $pk0, got $signed_pubkey"
+    fi
+
+    # Sign with index 1 and confirm different pubkey
+    local pk1 signed_pubkey1
+    pk1=$($CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/1'/0/0" get-public-key 2>/dev/null)
+    output=$(echo "$EVENT_JSON" | $CLIENT --socket-name "$REGROLE_SOCKET_NAME" --timeout 8000 --role nostr_range --path "m/44'/1237'/1'/0/0" sign-event 2>/dev/null) || {
+        fail "sign-event via nostr_range index 1" "exit code $?"
+        return
+    }
+    signed_pubkey1=$(json_get "pubkey" "$output")
+    if [ "$signed_pubkey1" = "$pk1" ] && [ "$signed_pubkey1" != "$signed_pubkey" ]; then
+        pass "sign-event nostr_range index 1 has correct and distinct pubkey"
+    else
+        fail "sign-event nostr_range index 1 has correct and distinct pubkey" "pk1=$pk1 signed=$signed_pubkey1 prev=$signed_pubkey"
+    fi
+}
+
+test_ml_dsa_65_roundtrip() {
+    echo ""
+    echo "=== ML-DSA-65 sign/verify round-trip ==="
+
+    local name="get-public-key --algorithm ml-dsa-65 --index 0"
+    local output
+    output=$($CLIENT --socket-name "$SOCKET_NAME" --algorithm ml-dsa-65 --index 0 get-public-key 2>/dev/null) || {
+        fail "$name" "exit code $?"
+        return
+    }
+    if printf '%s\n' "$output" | grep -q '"algorithm":"ml-dsa-65"' && \
+       printf '%s\n' "$output" | grep -q '"public_key"'; then
+        pass "$name"
+    else
+        fail "$name" "got: $output"
+        return
+    fi
+
+    name="sign --algorithm ml-dsa-65 --index 0 68656c6c6f"
+    local sig_raw sig
+    sig_raw=$($CLIENT --socket-name "$SOCKET_NAME" --algorithm ml-dsa-65 --index 0 sign "68656c6c6f" 2>/dev/null) || {
+        fail "$name" "exit code $?"
+        return
+    }
+    # Sign output is JSON: {"algorithm":"...","key_id":"...","signature":"<hex>"}
+    sig=$(echo "$sig_raw" | python3 -c "import sys,json; print(json.loads(sys.stdin.read()).get('signature',''))" 2>/dev/null)
+    if [ -z "$sig" ]; then
+        # Fallback: maybe raw hex
+        sig="$sig_raw"
+    fi
+    # ML-DSA-65 signatures are 3309 bytes = 6618 hex chars
+    if printf '%s\n' "$sig" | grep -qE '^[0-9a-f]{6618}$'; then
+        pass "$name (sig is 6618 hex chars)"
+    else
+        fail "$name (sig is 6618 hex chars)" "got length ${#sig}"
+        return
+    fi
+
+    name="verify --algorithm ml-dsa-65 --index 0 68656c6c6f (valid)"
+    output=$($CLIENT --socket-name "$SOCKET_NAME" --algorithm ml-dsa-65 --index 0 verify "68656c6c6f" "$sig" 2>/dev/null) || {
+        fail "$name" "exit code $?"
+        return
+    }
+    if printf '%s\n' "$output" | grep -qi 'valid\|true\|verified'; then
+        pass "$name"
+    else
+        fail "$name" "got: $output"
+    fi
+
+    name="verify --algorithm ml-dsa-65 --index 0 68656c6c6f (invalid sig)"
+    local wrong_sig
+    wrong_sig=$(printf '%06618s' 0 | tr ' ' '0')
+    set +e
+    output=$($CLIENT --socket-name "$SOCKET_NAME" --algorithm ml-dsa-65 --index 0 verify "68656c6c6f" "$wrong_sig" 2>/dev/null)
+    local rc=$?
+    set -e
+    if [ $rc -ne 0 ] || printf '%s\n' "$output" | grep -qi 'invalid\|false\|not'; then
+        pass "$name"
+    else
+        fail "$name" "rc=$rc output=$output"
+    fi
+}
+
+test_slh_dsa_128s_roundtrip() {
+    echo ""
+    echo "=== SLH-DSA-128s sign/verify round-trip ==="
+
+    local name="get-public-key --algorithm slh-dsa-128s --index 0"
+    local output
+    output=$($CLIENT --socket-name "$SOCKET_NAME" --algorithm slh-dsa-128s --index 0 get-public-key 2>/dev/null) || {
+        fail "$name" "exit code $?"
+        return
+    }
+    if printf '%s\n' "$output" | grep -q '"algorithm":"slh-dsa-128s"' && \
+       printf '%s\n' "$output" | grep -q '"public_key"'; then
+        pass "$name"
+    else
+        fail "$name" "got: $output"
+        return
+    fi
+
+    name="sign --algorithm slh-dsa-128s --index 0 68656c6c6f"
+    local sig_raw sig
+    sig_raw=$($CLIENT --socket-name "$SOCKET_NAME" --algorithm slh-dsa-128s --index 0 sign "68656c6c6f" 2>/dev/null) || {
+        fail "$name" "exit code $?"
+        return
+    }
+    # Sign output is JSON: {"algorithm":"...","key_id":"...","signature":"<hex>"}
+    sig=$(echo "$sig_raw" | python3 -c "import sys,json; print(json.loads(sys.stdin.read()).get('signature',''))" 2>/dev/null)
+    if [ -z "$sig" ]; then
+        sig="$sig_raw"
+    fi
+    # SLH-DSA-128s signatures are 7856 bytes = 15712 hex chars
+    if printf '%s\n' "$sig" | grep -qE '^[0-9a-f]{15712}$'; then
+        pass "$name (sig is 15712 hex chars)"
+    else
+        fail "$name (sig is 15712 hex chars)" "got length ${#sig}"
+        return
+    fi
+
+    name="verify --algorithm slh-dsa-128s --index 0 68656c6c6f (valid)"
+    output=$($CLIENT --socket-name "$SOCKET_NAME" --algorithm slh-dsa-128s --index 0 verify "68656c6c6f" "$sig" 2>/dev/null) || {
+        fail "$name" "exit code $?"
+        return
+    }
+    if printf '%s\n' "$output" | grep -qi 'valid\|true\|verified'; then
+        pass "$name"
+    else
+        fail "$name" "got: $output"
+    fi
+}
+
 test_otp_encrypt_decrypt() {
     echo ""
     echo "=== OTP encrypt/decrypt ==="
@@ -790,6 +1074,12 @@ start_server || {
     exit 1
 }
 
+# Start a second server with --register-role (template roles)
+start_server_regrole || {
+    echo "FATAL: could not start nsigner regrole server"
+    exit 1
+}
+
 # Run tests
 test_get_info
 test_get_public_key_nostr
@@ -799,11 +1089,18 @@ test_nip04_roundtrip
 test_nip44_roundtrip
 test_algorithm_verbs
 test_ml_kem_roundtrip
+test_ml_dsa_65_roundtrip
+test_slh_dsa_128s_roundtrip
 test_otp_encrypt_decrypt
 test_call_verb
 test_error_cases
 test_auto_discovery
 
+# Template-role tests (require regrole server)
+test_template_role_distinct_pubkeys
+test_template_role_path_rejection
+test_template_role_sign_event
+
 # Summary
 echo ""
 echo "============================================"