v0.0.27 - Refine TUI login flow, fix menu hotkey underlining, and pin connection info header

.roo/commands/push.md

@@ -1,5 +1,5 @@
 ---
-description: "Brief description of what this command does"
+description: "This command increments the version number and then adds, commits and pushes to the repo."
 ---
 
 Run increment_and_push.sh, and supply a good git commit message. For example:

Dockerfile.alpine-musl

@@ -55,6 +55,7 @@ RUN if [ "$(uname -m)" = "aarch64" ] && ! command -v aarch64-linux-gnu-gcc >/dev
 
 # Copy source files
 COPY src/ /build/src/
+COPY resources/tui_continuous/ /build/resources/tui_continuous/
 
 # Build nsigner as a fully static binary
 RUN ARCH="$(uname -m)"; \
@@ -68,6 +69,7 @@ RUN ARCH="$(uname -m)"; \
       -I/build/nostr_core_lib \
       -I/build/nostr_core_lib/nostr_core \
       -I/build/nostr_core_lib/cjson \
+      -I/build/resources/tui_continuous \
       /build/src/main.c \
       /build/src/secure_mem.c \
       /build/src/mnemonic.c \
@@ -80,6 +82,8 @@ RUN ARCH="$(uname -m)"; \
       /build/src/transport_frame.c \
       /build/src/key_store.c \
       /build/src/socket_name.c \
+      /build/src/auth_envelope.c \
+      /build/resources/tui_continuous/tui_continuous.c \
       "$NOSTR_LIB" \
       -o /build/nsigner_static \
       $(pkg-config --static --libs libcurl openssl) \

Makefile

@@ -1,10 +1,12 @@
 CC := gcc
-CFLAGS := -Wall -Wextra -std=c99 -Os -ffunction-sections -fdata-sections -Isrc -Iresources/nostr_core_lib -Iresources/nostr_core_lib/nostr_core -Iresources/nostr_core_lib/cjson
+CFLAGS := -Wall -Wextra -std=c99 -Os -ffunction-sections -fdata-sections -Isrc -Iresources/nostr_core_lib -Iresources/nostr_core_lib/nostr_core -Iresources/nostr_core_lib/cjson -Iresources/tui_continuous
 LDFLAGS := -Wl,--gc-sections resources/nostr_core_lib/libnostr_core_x64.a -lz -ldl -lpthread -lm -lssl -lcrypto -lcurl -lsecp256k1
 
 SRC_DIR := src
 BUILD_DIR := build
 TEST_DIR := tests
+CLIENT_DIR := client
+EXAMPLES_DIR := examples
 
 TARGET_DEV := $(BUILD_DIR)/nsigner
 
@@ -20,7 +22,9 @@ SOURCES := \
 	$(SRC_DIR)/server.c \
 	$(SRC_DIR)/transport_frame.c \
 	$(SRC_DIR)/key_store.c \
-	$(SRC_DIR)/socket_name.c
+	$(SRC_DIR)/socket_name.c \
+	$(SRC_DIR)/auth_envelope.c \
+	resources/tui_continuous/tui_continuous.c
 
 HEADERS :=
 
@@ -33,8 +37,13 @@ TEST_DISPATCHER_TARGET := $(BUILD_DIR)/test_dispatcher
 TEST_POLICY_TARGET := $(BUILD_DIR)/test_policy
 TEST_INTEGRATION_TARGET := $(BUILD_DIR)/test_integration
 TEST_SOCKET_NAME_TARGET := $(BUILD_DIR)/test_socket_name
+TEST_AUTH_ENVELOPE_TARGET := $(BUILD_DIR)/test_auth_envelope
+TEST_QREXEC_AUTH_TARGET := $(BUILD_DIR)/test_qrexec_auth
+TEST_MNEMONIC_INPUT_TARGET := $(BUILD_DIR)/test_mnemonic_input
+EXAMPLE_GET_PUBLIC_KEY_TARGET := $(BUILD_DIR)/example_get_public_key_client
+EXAMPLE_SIGN_EVENT_TARGET := $(BUILD_DIR)/example_sign_event_client
 
-.PHONY: all lib dev static static-debug static-arm64 test test-integration test-mnemonic test-role test-selector test-enforcement test-dispatcher test-policy test-socket-name clean
+.PHONY: all lib dev static static-debug static-arm64 test test-integration test-mnemonic test-mnemonic-input test-role test-selector test-enforcement test-dispatcher test-policy test-socket-name test-auth-envelope test-qrexec-auth examples test-client clean
 
 all: dev
 
@@ -59,7 +68,7 @@ static-arm64:
 	chmod +x ./build_static.sh
 	./build_static.sh --arch arm64
 
-test: lib test-mnemonic test-role test-selector test-enforcement test-dispatcher test-policy test-socket-name
+test: lib test-mnemonic test-mnemonic-input test-role test-selector test-enforcement test-dispatcher test-policy test-socket-name test-auth-envelope test-qrexec-auth test-client
 
 test-integration: $(TEST_INTEGRATION_TARGET) $(TARGET_DEV)
 	./$(TEST_INTEGRATION_TARGET)
@@ -67,6 +76,9 @@ test-integration: $(TEST_INTEGRATION_TARGET) $(TARGET_DEV)
 test-mnemonic: $(TEST_MNEMONIC_TARGET)
 	./$(TEST_MNEMONIC_TARGET)
 
+test-mnemonic-input: $(TEST_MNEMONIC_INPUT_TARGET)
+	./$(TEST_MNEMONIC_INPUT_TARGET)
+
 test-role: $(TEST_ROLE_TARGET)
 	./$(TEST_ROLE_TARGET)
 
@@ -85,10 +97,24 @@ test-policy: $(TEST_POLICY_TARGET)
 test-socket-name: $(TEST_SOCKET_NAME_TARGET)
 	./$(TEST_SOCKET_NAME_TARGET)
 
+test-auth-envelope: $(TEST_AUTH_ENVELOPE_TARGET)
+	./$(TEST_AUTH_ENVELOPE_TARGET)
+
+test-qrexec-auth: $(TEST_QREXEC_AUTH_TARGET) $(TARGET_DEV)
+	./$(TEST_QREXEC_AUTH_TARGET)
+
+test-client: examples
+
+examples: $(EXAMPLE_GET_PUBLIC_KEY_TARGET) $(EXAMPLE_SIGN_EVENT_TARGET)
+
 $(TEST_MNEMONIC_TARGET): $(TEST_DIR)/test_mnemonic.c $(SRC_DIR)/mnemonic.c $(SRC_DIR)/secure_mem.c
 	@mkdir -p $(BUILD_DIR)
 	$(CC) $(CFLAGS) $(TEST_DIR)/test_mnemonic.c $(SRC_DIR)/mnemonic.c $(SRC_DIR)/secure_mem.c -o $(TEST_MNEMONIC_TARGET) $(LDFLAGS)
 
+$(TEST_MNEMONIC_INPUT_TARGET): $(TEST_DIR)/test_mnemonic_input.c
+	@mkdir -p $(BUILD_DIR)
+	$(CC) $(CFLAGS) -I$(CLIENT_DIR) $(TEST_DIR)/test_mnemonic_input.c -o $(TEST_MNEMONIC_INPUT_TARGET) $(LDFLAGS)
+
 $(TEST_ROLE_TARGET): $(TEST_DIR)/test_role_table.c $(SRC_DIR)/role_table.c
 	@mkdir -p $(BUILD_DIR)
 	$(CC) $(CFLAGS) $(TEST_DIR)/test_role_table.c $(SRC_DIR)/role_table.c -o $(TEST_ROLE_TARGET) $(LDFLAGS)
@@ -109,13 +135,29 @@ $(TEST_POLICY_TARGET): $(TEST_DIR)/test_policy.c $(SRC_DIR)/policy.c
 	@mkdir -p $(BUILD_DIR)
 	$(CC) $(CFLAGS) $(TEST_DIR)/test_policy.c $(SRC_DIR)/policy.c -o $(TEST_POLICY_TARGET) $(LDFLAGS)
 
-$(TEST_INTEGRATION_TARGET): $(TEST_DIR)/test_integration.c
+$(TEST_INTEGRATION_TARGET): $(TEST_DIR)/test_integration.c $(CLIENT_DIR)/nsigner_client.c $(SRC_DIR)/auth_envelope.c
 	@mkdir -p $(BUILD_DIR)
-	$(CC) $(CFLAGS) $(TEST_DIR)/test_integration.c -o $(TEST_INTEGRATION_TARGET) $(LDFLAGS)
+	$(CC) $(CFLAGS) -I$(CLIENT_DIR) $(TEST_DIR)/test_integration.c $(CLIENT_DIR)/nsigner_client.c $(SRC_DIR)/auth_envelope.c -o $(TEST_INTEGRATION_TARGET) $(LDFLAGS)
 
 $(TEST_SOCKET_NAME_TARGET): $(TEST_DIR)/test_socket_name.c $(SRC_DIR)/socket_name.c
 	@mkdir -p $(BUILD_DIR)
 	$(CC) $(CFLAGS) $(TEST_DIR)/test_socket_name.c $(SRC_DIR)/socket_name.c -o $(TEST_SOCKET_NAME_TARGET) $(LDFLAGS)
 
+$(TEST_AUTH_ENVELOPE_TARGET): $(TEST_DIR)/test_auth_envelope.c $(SRC_DIR)/auth_envelope.c
+	@mkdir -p $(BUILD_DIR)
+	$(CC) $(CFLAGS) $(TEST_DIR)/test_auth_envelope.c $(SRC_DIR)/auth_envelope.c -o $(TEST_AUTH_ENVELOPE_TARGET) $(LDFLAGS)
+
+$(TEST_QREXEC_AUTH_TARGET): $(TEST_DIR)/test_qrexec_auth.c $(SRC_DIR)/auth_envelope.c
+	@mkdir -p $(BUILD_DIR)
+	$(CC) $(CFLAGS) $(TEST_DIR)/test_qrexec_auth.c $(SRC_DIR)/auth_envelope.c -o $(TEST_QREXEC_AUTH_TARGET) $(LDFLAGS)
+
+$(EXAMPLE_GET_PUBLIC_KEY_TARGET): $(EXAMPLES_DIR)/get_public_key_client.c $(CLIENT_DIR)/nsigner_client.c $(SRC_DIR)/auth_envelope.c
+	@mkdir -p $(BUILD_DIR)
+	$(CC) $(CFLAGS) -I$(CLIENT_DIR) $(EXAMPLES_DIR)/get_public_key_client.c $(CLIENT_DIR)/nsigner_client.c $(SRC_DIR)/auth_envelope.c -o $(EXAMPLE_GET_PUBLIC_KEY_TARGET) $(LDFLAGS)
+
+$(EXAMPLE_SIGN_EVENT_TARGET): $(EXAMPLES_DIR)/sign_event_client.c $(CLIENT_DIR)/nsigner_client.c $(SRC_DIR)/auth_envelope.c
+	@mkdir -p $(BUILD_DIR)
+	$(CC) $(CFLAGS) -I$(CLIENT_DIR) $(EXAMPLES_DIR)/sign_event_client.c $(CLIENT_DIR)/nsigner_client.c $(SRC_DIR)/auth_envelope.c -o $(EXAMPLE_SIGN_EVENT_TARGET) $(LDFLAGS)
+
 clean:
 	rm -rf $(BUILD_DIR)

README.md

@@ -80,6 +80,13 @@ When started, `n_signer` immediately enters terminal input mode:
 
 No startup files are read or written. The mnemonic — typed or generated — lives only in `mlock`'d memory and is zeroized on shutdown or crash.
 
+For parent-process launchers, startup can also be non-interactive:
+
+- `--mnemonic-stdin`: read one mnemonic line from stdin at startup, then continue normally.
+- `--mnemonic-fd N`: read one mnemonic line from inherited file descriptor `N` at startup.
+
+These modes avoid putting mnemonic material in argv/environment and are designed for supervised spawners. See [`plans/mnemonic_startup_input.md`](plans/mnemonic_startup_input.md) for the full behavior contract.
+
 ### 3.2 Running phase (status display + signer)
 
 After unlock, terminal becomes a live status and control console. Example layout:
@@ -366,6 +373,7 @@ Build outputs a single executable artifact.
 - [`build_static.sh`](build_static.sh): musl-static build path
 - [`Makefile`](Makefile): local build targets
 - [`Dockerfile.alpine-musl`](Dockerfile.alpine-musl): reproducible Alpine musl toolchain
+- [`resources/tui_continuous/tui_continuous.h`](resources/tui_continuous/tui_continuous.h) + [`resources/tui_continuous/tui_continuous.c`](resources/tui_continuous/tui_continuous.c): vendored continuous-TUI component (from `~/lt/aesthetics`, API baseline `TUI_CONTINUOUS_VERSION 0.0.9`)
 - [`increment_and_push.sh`](increment_and_push.sh): version/tag/release workflow
 - [`src/main.c`](src/main.c): version macros (`NSIGNER_VERSION*`)
 

client/README.md

@@ -0,0 +1,47 @@
+# n_signer C Reference Client
+
+This directory provides a minimal copy/paste-friendly C client for `n_signer`.
+
+## Files
+
+- `nsigner_client.h` / `nsigner_client.c`:
+  - Unix abstract socket connect helper
+  - length-prefixed frame send/receive
+  - generic request API
+  - helpers for `get_public_key` and `sign_event`
+  - optional TCP auth envelope attachment via `auth_envelope_build_for_request()`
+
+## API at a glance
+
+```c
+nsigner_client_t client;
+nsigner_client_init(&client);
+
+nsigner_client_connect_unix(&client, "nsigner", 5000);
+
+char *resp = NULL;
+nsigner_client_get_public_key(&client, "1", "", &resp);
+free(resp);
+
+nsigner_client_close(&client);
+```
+
+## Auth envelope usage
+
+If transport requires auth envelopes (for TCP mode), set a private key once:
+
+```c
+unsigned char privkey[32] = { /* caller key */ };
+nsigner_client_set_auth(&client, privkey, "example-client");
+```
+
+Subsequent requests automatically include an `auth` object.
+
+## Ownership rules
+
+- Any `out_response_json` returned by the API must be freed by caller using `free()`.
+- `nsigner_client_close()` only closes the socket; it does not free the client struct itself.
+
+## License
+
+Source files in this directory use SPDX `0BSD` headers for permissive reuse in external projects.

client/nsigner_client.c

@@ -0,0 +1,369 @@
+/*
+ * SPDX-License-Identifier: 0BSD
+ */
+
+#define _GNU_SOURCE
+
+#include "nsigner_client.h"
+
+#include <arpa/inet.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/un.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <cJSON.h>
+
+#include "auth_envelope.h"
+
+#define NSIGNER_CLIENT_MAX_FRAME (65536U)
+
+static void client_set_error(nsigner_client_t *client, const char *fmt, ...) {
+    va_list ap;
+
+    if (client == NULL) {
+        return;
+    }
+
+    va_start(ap, fmt);
+    vsnprintf(client->last_error, sizeof(client->last_error), fmt, ap);
+    va_end(ap);
+}
+
+static int write_full(int fd, const void *buf, size_t len) {
+    const unsigned char *p = (const unsigned char *)buf;
+    size_t off = 0;
+
+    while (off < len) {
+        ssize_t n = write(fd, p + off, len - off);
+        if (n < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            return -1;
+        }
+        off += (size_t)n;
+    }
+
+    return 0;
+}
+
+static int read_full(int fd, void *buf, size_t len) {
+    unsigned char *p = (unsigned char *)buf;
+    size_t off = 0;
+
+    while (off < len) {
+        ssize_t n = read(fd, p + off, len - off);
+        if (n == 0) {
+            return -1;
+        }
+        if (n < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            return -1;
+        }
+        off += (size_t)n;
+    }
+
+    return 0;
+}
+
+static int send_framed(int fd, const char *payload) {
+    uint32_t len;
+    uint32_t be_len;
+
+    if (payload == NULL) {
+        return -1;
+    }
+
+    len = (uint32_t)strlen(payload);
+    be_len = htonl(len);
+
+    if (write_full(fd, &be_len, sizeof(be_len)) != 0) {
+        return -1;
+    }
+    if (write_full(fd, payload, len) != 0) {
+        return -1;
+    }
+
+    return 0;
+}
+
+static int recv_framed(int fd, char **out_payload) {
+    uint32_t be_len;
+    uint32_t len;
+    char *payload;
+
+    if (out_payload == NULL) {
+        return -1;
+    }
+
+    *out_payload = NULL;
+
+    if (read_full(fd, &be_len, sizeof(be_len)) != 0) {
+        return -1;
+    }
+
+    len = ntohl(be_len);
+    if (len == 0 || len > NSIGNER_CLIENT_MAX_FRAME) {
+        return -1;
+    }
+
+    payload = (char *)malloc((size_t)len + 1U);
+    if (payload == NULL) {
+        return -1;
+    }
+
+    if (read_full(fd, payload, len) != 0) {
+        free(payload);
+        return -1;
+    }
+
+    payload[len] = '\0';
+    *out_payload = payload;
+    return 0;
+}
+
+static int sleep_ms(int ms) {
+    struct timespec ts;
+    ts.tv_sec = ms / 1000;
+    ts.tv_nsec = (long)(ms % 1000) * 1000000L;
+    return nanosleep(&ts, NULL);
+}
+
+void nsigner_client_init(nsigner_client_t *client) {
+    if (client == NULL) {
+        return;
+    }
+
+    memset(client, 0, sizeof(*client));
+    client->fd = -1;
+    client->timeout_ms = 5000;
+}
+
+void nsigner_client_close(nsigner_client_t *client) {
+    if (client == NULL) {
+        return;
+    }
+
+    if (client->fd >= 0) {
+        close(client->fd);
+        client->fd = -1;
+    }
+}
+
+int nsigner_client_connect_unix(nsigner_client_t *client,
+                                const char *socket_name,
+                                int timeout_ms) {
+    struct sockaddr_un addr;
+    socklen_t addr_len;
+    int elapsed = 0;
+
+    if (client == NULL || socket_name == NULL || socket_name[0] == '\0') {
+        return -1;
+    }
+
+    timeout_ms = (timeout_ms > 0) ? timeout_ms : 5000;
+    nsigner_client_close(client);
+
+    memset(&addr, 0, sizeof(addr));
+    addr.sun_family = AF_UNIX;
+    addr.sun_path[0] = '\0';
+    strncpy(&addr.sun_path[1], socket_name, sizeof(addr.sun_path) - 2);
+    addr.sun_path[sizeof(addr.sun_path) - 1] = '\0';
+    addr_len = (socklen_t)(sizeof(sa_family_t) + 1 + strlen(socket_name));
+
+    while (elapsed < timeout_ms) {
+        int fd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (fd < 0) {
+            client_set_error(client, "socket failed: %s", strerror(errno));
+            return -1;
+        }
+
+        if (connect(fd, (struct sockaddr *)&addr, addr_len) == 0) {
+            client->fd = fd;
+            client->timeout_ms = timeout_ms;
+            client_set_error(client, "ok");
+            return 0;
+        }
+
+        close(fd);
+        sleep_ms(100);
+        elapsed += 100;
+    }
+
+    client_set_error(client, "connect timeout: %s", strerror(errno));
+    return -1;
+}
+
+int nsigner_client_set_auth(nsigner_client_t *client,
+                            const unsigned char privkey[32],
+                            const char *label) {
+    if (client == NULL || privkey == NULL) {
+        return -1;
+    }
+
+    memcpy(client->auth_privkey, privkey, 32);
+    client->auth_enabled = 1;
+
+    if (label == NULL) {
+        label = "";
+    }
+    strncpy(client->auth_label, label, sizeof(client->auth_label) - 1);
+    client->auth_label[sizeof(client->auth_label) - 1] = '\0';
+
+    return 0;
+}
+
+const char *nsigner_client_last_error(const nsigner_client_t *client) {
+    if (client == NULL) {
+        return "invalid_client";
+    }
+    return client->last_error;
+}
+
+int nsigner_client_request_raw(nsigner_client_t *client,
+                               const char *request_json,
+                               char **out_response_json) {
+    char *response_json = NULL;
+
+    if (client == NULL || request_json == NULL || out_response_json == NULL) {
+        return -1;
+    }
+    if (client->fd < 0) {
+        client_set_error(client, "not connected");
+        return -1;
+    }
+
+    *out_response_json = NULL;
+
+    if (send_framed(client->fd, request_json) != 0) {
+        client_set_error(client, "send failed");
+        return -1;
+    }
+
+    if (recv_framed(client->fd, &response_json) != 0) {
+        client_set_error(client, "receive failed");
+        return -1;
+    }
+
+    *out_response_json = response_json;
+    client_set_error(client, "ok");
+    return 0;
+}
+
+int nsigner_client_request(nsigner_client_t *client,
+                           const char *id,
+                           const char *method,
+                           const cJSON *params,
+                           char **out_response_json) {
+    cJSON *root = NULL;
+    cJSON *params_copy = NULL;
+    cJSON *auth = NULL;
+    char *request_json = NULL;
+    int rc = -1;
+
+    if (client == NULL || id == NULL || method == NULL || out_response_json == NULL) {
+        return -1;
+    }
+
+    root = cJSON_CreateObject();
+    if (root == NULL) {
+        client_set_error(client, "out of memory");
+        goto cleanup;
+    }
+
+    cJSON_AddStringToObject(root, "id", id);
+    cJSON_AddStringToObject(root, "method", method);
+
+    if (params != NULL) {
+        params_copy = cJSON_Duplicate((cJSON *)params, 1);
+    } else {
+        params_copy = cJSON_CreateArray();
+    }
+
+    if (params_copy == NULL) {
+        client_set_error(client, "failed to create params");
+        goto cleanup;
+    }
+    cJSON_AddItemToObject(root, "params", params_copy);
+
+    if (client->auth_enabled) {
+        if (auth_envelope_build_for_request(id,
+                                            method,
+                                            params_copy,
+                                            client->auth_privkey,
+                                            client->auth_label,
+                                            time(NULL),
+                                            &auth) != 0) {
+            client_set_error(client, "failed to build auth envelope");
+            goto cleanup;
+        }
+        cJSON_AddItemToObject(root, "auth", auth);
+        auth = NULL;
+    }
+
+    request_json = cJSON_PrintUnformatted(root);
+    if (request_json == NULL) {
+        client_set_error(client, "failed to serialize request");
+        goto cleanup;
+    }
+
+    rc = nsigner_client_request_raw(client, request_json, out_response_json);
+
+cleanup:
+    cJSON_Delete(root);
+    cJSON_Delete(auth);
+    free(request_json);
+    return rc;
+}
+
+int nsigner_client_get_public_key(nsigner_client_t *client,
+                                  const char *id,
+                                  const char *selector,
+                                  char **out_response_json) {
+    cJSON *params = cJSON_CreateArray();
+    int rc;
+
+    if (params == NULL) {
+        return -1;
+    }
+
+    cJSON_AddItemToArray(params, cJSON_CreateString((selector != NULL) ? selector : ""));
+    rc = nsigner_client_request(client, id, "get_public_key", params, out_response_json);
+    cJSON_Delete(params);
+    return rc;
+}
+
+int nsigner_client_sign_event(nsigner_client_t *client,
+                              const char *id,
+                              const char *event_json,
+                              const char *role,
+                              char **out_response_json) {
+    cJSON *params = cJSON_CreateArray();
+    cJSON *opts = cJSON_CreateObject();
+    int rc;
+
+    if (params == NULL || opts == NULL || event_json == NULL) {
+        cJSON_Delete(params);
+        cJSON_Delete(opts);
+        return -1;
+    }
+
+    cJSON_AddItemToArray(params, cJSON_CreateString(event_json));
+    if (role != NULL && role[0] != '\0') {
+        cJSON_AddStringToObject(opts, "role", role);
+    }
+    cJSON_AddItemToArray(params, opts);
+
+    rc = nsigner_client_request(client, id, "sign_event", params, out_response_json);
+    cJSON_Delete(params);
+    return rc;
+}

client/nsigner_client.h

@@ -0,0 +1,56 @@
+/*
+ * SPDX-License-Identifier: 0BSD
+ */
+
+#ifndef NSIGNER_CLIENT_H
+#define NSIGNER_CLIENT_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <cJSON.h>
+
+typedef struct {
+    int fd;
+    int timeout_ms;
+    unsigned char auth_privkey[32];
+    int auth_enabled;
+    char auth_label[64];
+    char last_error[128];
+} nsigner_client_t;
+
+void nsigner_client_init(nsigner_client_t *client);
+void nsigner_client_close(nsigner_client_t *client);
+
+int nsigner_client_connect_unix(nsigner_client_t *client,
+                                const char *socket_name,
+                                int timeout_ms);
+
+int nsigner_client_set_auth(nsigner_client_t *client,
+                            const unsigned char privkey[32],
+                            const char *label);
+
+const char *nsigner_client_last_error(const nsigner_client_t *client);
+
+int nsigner_client_request_raw(nsigner_client_t *client,
+                               const char *request_json,
+                               char **out_response_json);
+
+int nsigner_client_request(nsigner_client_t *client,
+                           const char *id,
+                           const char *method,
+                           const cJSON *params,
+                           char **out_response_json);
+
+int nsigner_client_get_public_key(nsigner_client_t *client,
+                                  const char *id,
+                                  const char *selector,
+                                  char **out_response_json);
+
+int nsigner_client_sign_event(nsigner_client_t *client,
+                              const char *id,
+                              const char *event_json,
+                              const char *role,
+                              char **out_response_json);
+
+#endif

documents/CLIENT_IMPLEMENTATION.md

@@ -6,14 +6,21 @@ This document is the client-integration spec for `nsigner`.
 
 It is written for agent/tool authors implementing robust request flows against the local signer process.
 
+Reference implementation in this repository:
+
+- Reusable C client library: `client/nsigner_client.h` + `client/nsigner_client.c`
+- Minimal usage examples: `examples/get_public_key_client.c` and `examples/sign_event_client.c`
+- Auth envelope builder used by the client: `src/auth_envelope.h` (`auth_envelope_build_for_request`)
+
 ---
 
 ## 2. Discovery and socket targeting
 
-`nsigner` currently supports two transport families:
+`nsigner` currently supports three transport families:
 
 - Linux AF_UNIX **abstract namespace** sockets.
 - Stdio framed mode (`--listen stdio` and `--listen qrexec`) for one request/response exchange.
+- TCP framed mode (`--listen tcp:IPv4:PORT` or `--listen tcp:[IPv6]:PORT`).
 
 For AF_UNIX:
 
@@ -54,6 +61,24 @@ In server mode:
 
 This mode is server-side only in the current CLI (the `client` subcommand still targets AF_UNIX).
 
+### 2.4 qrexec authentication posture (`--auth`)
+
+qrexec now supports configurable auth-envelope handling:
+
+- `--listen qrexec --auth off` (default): legacy behavior. Requests are authorized as `qubes:<vm-name>` only.
+- `--listen qrexec --auth optional`: if the request includes an `auth` field, it is verified using the same auth envelope rules as TCP. On success, caller identity is upgraded to `qubes:<vm-name>+pubkey:<hex>`.
+- `--listen qrexec --auth required`: every request must carry a valid `auth` envelope, and caller identity is `qubes:<vm-name>+pubkey:<hex>`.
+
+When `--auth optional` is used, a malformed or invalid `auth` object is rejected with auth-layer errors (`2010..2017`) rather than silently falling back to `qubes:<vm-name>`.
+
+### 2.5 TCP mode authentication (required)
+
+For TCP transport, requests MUST include an `auth` object containing a signed Nostr-style event envelope.
+
+- Missing `auth` returns `{"error":{"code":2014,"message":"auth_envelope_required"}}`.
+- Signature verification, method/id/body binding, timestamp skew checks, and replay checks are enforced before policy lookup.
+- On success, caller identity is normalized to `pubkey:<hex>` for policy checks.
+
 ---
 
 ## 3. Transport framing
@@ -147,6 +172,14 @@ Representative error names clients must handle:
 - `unauthorized`
 - `approval_denied`
 - `internal_error`
+- `auth_envelope_malformed` (2010)
+- `auth_body_mismatch` (2011)
+- `auth_signature_invalid` (2012)
+- `auth_kind_invalid` (2013)
+- `auth_envelope_required` (2014)
+- `auth_envelope_mismatch` (2015)
+- `auth_envelope_stale` (2016)
+- `auth_replay_detected` (2017)
 
 ### 5.1 Recovery guidance
 
@@ -158,6 +191,7 @@ Representative error names clients must handle:
 - `unauthorized`: caller identity disallowed by policy; do not blind-retry.
 - `approval_denied`: user rejected prompt; treat as final unless user initiates retry.
 - `internal_error`: bounded retry with backoff; surface diagnostics.
+- `auth_envelope_*` / `auth_*` (2010-2017): fix request signing/auth envelope generation; do not blind-retry unchanged payloads.
 
 ---
 

documents/QUBES_OS.md

@@ -49,6 +49,16 @@ Still missing for complete Qubes integration:
 - qrexec policy in dom0 remains first enforcement boundary.
 - `n_signer` policy/approval remains second boundary.
 
+### 3.4 Optional per-program identity inside one qube (`--auth optional`)
+
+qrexec now supports an optional auth-envelope layer:
+
+- `nsigner --listen qrexec --auth off` (default): identity remains `qubes:<source-vm>`.
+- `nsigner --listen qrexec --auth optional`: if a caller includes a valid auth envelope, identity becomes `qubes:<source-vm>+pubkey:<hex>`.
+- `nsigner --listen qrexec --auth required`: all requests must carry valid envelopes and identity is always `qubes:<source-vm>+pubkey:<hex>`.
+
+This enables per-program approvals inside a single caller qube while preserving existing behavior for legacy callers that do not emit auth envelopes.
+
 ---
 
 ## 4. Required implementation tasks
@@ -102,6 +112,12 @@ In qrexec mode, default prompt behavior is now:
 
 This replaces the previous permissive `PROMPT_NEVER` temporary setting.
 
+If qrexec auth envelopes are enabled (`--auth optional` or `--auth required`), approved callers can also be recorded as composite identities:
+
+- `qubes:<vm>+pubkey:<hex>`
+
+This gives independent approval rows for distinct programs running in the same source qube.
+
 ## 4.4 Client helper examples ✅ Implemented
 
 Added:
@@ -135,6 +151,7 @@ Includes:
 - from caller qube, invoke test request (`get_public_key`)
 - confirm signer qube receives request
 - confirm activity log displays `qubes:<source-vm>` caller prefix
+- with `--auth optional`, confirm envelope-enabled clients show `qubes:<source-vm>+pubkey:<hex>`
 - validate deny behavior from unauthorized qube
 
 ## 5.4 Failure checks

documents/SECURITY.md

@@ -21,6 +21,8 @@ The security posture is intentionally minimalist:
 
 Authoritative behavior reference: [`README.md`](../README.md). Implementation roadmap: [`plans/nsigner.md`](../plans/nsigner.md). Approval model plan: [`plans/deny_by_default_approvals.md`](../plans/deny_by_default_approvals.md). Wire contract for clients: [`documents/CLIENT_IMPLEMENTATION.md`](CLIENT_IMPLEMENTATION.md).
 
+Interactive terminal presentation now follows the continuous-TUI conventions from `~/lt/aesthetics/TUI.md`, implemented via vendored [`resources/tui_continuous/tui_continuous.h`](../resources/tui_continuous/tui_continuous.h) / [`resources/tui_continuous/tui_continuous.c`](../resources/tui_continuous/tui_continuous.c) (baseline `TUI_CONTINUOUS_VERSION 0.0.9`).
+
 ---
 
 ## 2. Threat model
@@ -49,6 +51,7 @@ Authoritative behavior reference: [`README.md`](../README.md). Implementation ro
 | The kernel and `mlock` / `getrandom` syscalls | Used for in-memory protection and entropy. |
 | The static binary itself | Built reproducibly via [`build_static.sh`](../build_static.sh) and shipped as one musl-static artifact. |
 | The launcher that started `n_signer` | Whoever ran the process chose the `--preapprove` flags. In interactive use that's the human; in `n_OS_tr` boot it's the OS init system. The launcher's integrity is part of the trust chain. |
+| Parent process (when using `--mnemonic-stdin` / `--mnemonic-fd`) | In non-interactive startup mode, the parent provides mnemonic bytes over stdin/inherited FD. That parent is now explicitly in the trust chain for mnemonic handling correctness and secrecy. |
 
 Everything else — clients, other processes, other users, remote callers — is **untrusted by default** and must clear an approval check.
 
@@ -94,12 +97,13 @@ An identity is a tagged caller record built from the transport. Different transp
 |---|---|---|
 | `unix_peer` | `uid`, `pid` from `SO_PEERCRED` on an abstract Unix socket. | Kernel — the client cannot forge it. |
 | `qubes` | source qube name from `QREXEC_REMOTE_DOMAIN`. | Qubes RPC framework. |
+| `qubes_pubkey` | source qube + verified auth-envelope pubkey (`qubes:<vm>+pubkey:<hex>`). | Qubes RPC framework + application-layer signature verification. |
 | `tcp_local` | Loopback address of caller. | TCP socket peer address — opt-in transport. |
-| `tcp_remote` | Address plus an authenticated pubkey (planned). | Application-layer authentication. |
+| `tcp_remote` | Verified auth-envelope pubkey (`pubkey:<hex>`). | Application-layer authentication. |
 | `fips` | Peer npub from a NIP-46 style flow (planned). | Application-layer authentication. |
 | `usb_serial` | Device path plus an asserted caller (planned). | Trust-on-first-use. |
 
-Identity quality varies. `unix_peer` and `qubes` are vouched for by the kernel or hypervisor — strong. `tcp_local` and `tcp_remote` are transport-asserted only — only as good as the human at the terminal who chose to approve them.
+Identity quality varies. `unix_peer` and `qubes` are vouched for by the kernel or hypervisor — strong. `qubes_pubkey` is stronger still for multi-program qubes because it combines hypervisor-vouched source-qube identity with a per-program cryptographic identity. `tcp_local` and `tcp_remote` rely on transport/app-layer checks and are only as strong as deployment choices.
 
 ### Index (or path) — *which key*
 
@@ -423,14 +427,16 @@ Different transports give different identity quality. The wire format (4-byte le
 ### 11.2 Stdio / qrexec mode
 
 - One framed request, one framed response, then exit.
-- Identity: `qubes:<vm-name>` from `QREXEC_REMOTE_DOMAIN`, vouched for by Qubes.
+- Identity defaults to `qubes:<vm-name>` from `QREXEC_REMOTE_DOMAIN`, vouched for by Qubes.
+- With `--listen qrexec --auth optional|required`, requests carrying a valid auth envelope are upgraded to `qubes:<vm-name>+pubkey:<hex>`.
 - Risk surface: only what Qubes RPC policy permits. See [`packaging/qubes/`](../packaging/qubes/).
 
 ### 11.3 TCP (advanced / opt-in)
 
-- Loopback addresses produce `tcp_local` identities. Remote addresses produce `tcp_remote` identities.
-- Identity is **transport-asserted only**. The TCP peer address proves a route, not a principal.
-- For TCP transports the **interactive approval prompt is the real authentication mechanism**. Do not enable TCP transports without a trustworthy local terminal.
+- Loopback and remote TCP callers must present a valid signed auth envelope.
+- Identity is normalized to caller `pubkey:<hex>` after signature verification; TCP peer address is context only.
+- The auth gate runs before policy: missing/invalid envelopes are rejected with `2010..2017` auth errors.
+- Prompt-driven approval still applies after auth; auth answers "who is calling", policy answers "is this caller allowed".
 
 ### 11.4 Future transports
 

examples/get_public_key_client.c

@@ -0,0 +1,32 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "../client/nsigner_client.h"
+
+int main(int argc, char **argv) {
+    const char *socket_name = "nsigner";
+    nsigner_client_t client;
+    char *response = NULL;
+
+    if (argc > 1 && argv[1] != NULL && argv[1][0] != '\0') {
+        socket_name = argv[1];
+    }
+
+    nsigner_client_init(&client);
+
+    if (nsigner_client_connect_unix(&client, socket_name, 5000) != 0) {
+        fprintf(stderr, "connect failed: %s\n", nsigner_client_last_error(&client));
+        return 1;
+    }
+
+    if (nsigner_client_get_public_key(&client, "example-1", "", &response) != 0) {
+        fprintf(stderr, "request failed: %s\n", nsigner_client_last_error(&client));
+        nsigner_client_close(&client);
+        return 1;
+    }
+
+    printf("%s\n", response);
+    free(response);
+    nsigner_client_close(&client);
+    return 0;
+}

examples/sign_event_client.c

@@ -0,0 +1,33 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "../client/nsigner_client.h"
+
+int main(int argc, char **argv) {
+    const char *socket_name = "nsigner";
+    const char *event_json = "{\"kind\":1,\"content\":\"hello from client example\",\"tags\":[],\"created_at\":1700000000}";
+    nsigner_client_t client;
+    char *response = NULL;
+
+    if (argc > 1 && argv[1] != NULL && argv[1][0] != '\0') {
+        socket_name = argv[1];
+    }
+
+    nsigner_client_init(&client);
+
+    if (nsigner_client_connect_unix(&client, socket_name, 5000) != 0) {
+        fprintf(stderr, "connect failed: %s\n", nsigner_client_last_error(&client));
+        return 1;
+    }
+
+    if (nsigner_client_sign_event(&client, "example-2", event_json, "main", &response) != 0) {
+        fprintf(stderr, "request failed: %s\n", nsigner_client_last_error(&client));
+        nsigner_client_close(&client);
+        return 1;
+    }
+
+    printf("%s\n", response);
+    free(response);
+    nsigner_client_close(&client);
+    return 0;
+}

increment_and_push.sh

@@ -153,14 +153,42 @@ git_commit_and_push_no_tag() {
     git push origin "$NEW_VERSION" || git push --force origin "$NEW_VERSION"
 }
 
+verify_binary_version() {
+    local bin_path="$1"
+    local expected="$2"
+
+    if [[ ! -x "$bin_path" ]]; then
+        print_error "Binary not found or not executable: $bin_path"
+        return 1
+    fi
+
+    local got
+    got="$($bin_path --version 2>/dev/null | awk '{print $2}')"
+    if [[ "$got" != "$expected" ]]; then
+        print_error "Binary version mismatch for $(basename "$bin_path"): expected $expected, got ${got:-<unknown>}"
+        return 1
+    fi
+
+    return 0
+}
+
 build_release_binary() {
     if [[ ! -f "build_static.sh" ]]; then
         print_error "build_static.sh not found"
         return 1
     fi
 
+    # Prevent stale artifacts from previous builds being uploaded.
+    rm -f build/nsigner_static_x86_64 build/nsigner_static_arm64
+
     ./build_static.sh > /dev/null 2>&1 || return 1
+    verify_binary_version "build/nsigner_static_x86_64" "$NEW_VERSION" || return 1
+
     ./build_static.sh --arch arm64 > /dev/null 2>&1 || print_warning "ARM64 build failed (continuing)"
+    if [[ -x "build/nsigner_static_arm64" ]]; then
+        verify_binary_version "build/nsigner_static_arm64" "$NEW_VERSION" || return 1
+    fi
+
     return 0
 }
 
@@ -253,9 +281,12 @@ main() {
             git tag "$NEW_VERSION" > /dev/null 2>&1
         fi
 
-        git_commit_and_push_no_tag
+        if ! build_release_binary; then
+            print_error "x86_64 release build failed; aborting release before push/upload"
+            exit 1
+        fi
 
-        build_release_binary || print_warning "x86_64 build failed"
+        git_commit_and_push_no_tag
 
         local binary_path_x86="build/nsigner_static_x86_64"
         local binary_path_arm64="build/nsigner_static_arm64"

install_qube_fips_nsigner.sh

@@ -110,6 +110,32 @@ download_nsigner_asset_url() {
     | head -n1 || true
 }
 
+verify_installed_version() {
+  local expected="$1"
+  local got_line=""
+  local got_ver=""
+
+  if [[ ! -x "${PREFIX_BIN}/nsigner" ]]; then
+    err "Installed binary missing: ${PREFIX_BIN}/nsigner"
+    exit 1
+  fi
+
+  got_line="$("${PREFIX_BIN}/nsigner" --version 2>/dev/null || true)"
+  got_ver="$(printf '%s\n' "${got_line}" | awk '{print $2}')"
+
+  if [[ -z "${got_ver}" ]]; then
+    err "Could not determine installed n_signer version from: ${got_line}"
+    exit 1
+  fi
+
+  if [[ "${got_ver}" != "${expected}" ]]; then
+    err "Downloaded binary version mismatch: expected ${expected}, got ${got_ver}"
+    err "Release asset appears stale or mislabeled."
+    err "Use NSIGNER_BINARY_URL to pin a known-good binary, or wait for a rebuilt release artifact."
+    exit 1
+  fi
+}
+
 install_nsigner() {
   local release_page=""
 
@@ -137,6 +163,8 @@ install_nsigner() {
     curl -fL -o "${PREFIX_BIN}/nsigner" "${asset_url}"
   fi
   chmod 0755 "${PREFIX_BIN}/nsigner"
+
+  verify_installed_version "${NSIGNER_VERSION}"
   log "Installed ${PREFIX_BIN}/nsigner from release binary"
 }
 

plans/auth_envelope_other_transports.md

@@ -0,0 +1,271 @@
+# Plan: Where else does the Schnorr auth envelope earn its keep?
+
+Status: **draft v1 — design exploration, for review**
+
+> **Origin.** [`plans/caller_token_identity.md`](caller_token_identity.md) introduced a per-request, BIP-340-Schnorr-signed *auth envelope* (Nostr kind 27235) that gives the TCP transport an application-layer identity. The TCP plan was deliberate about scope: AF_UNIX and qrexec keep their kernel/hypervisor identities, stdio inherits them, and the envelope is gated to TCP only. This document asks the next obvious question — **for which other transports is the same envelope actually useful, and where is it noise or worse?** — and proposes a small, conservative extension.
+
+The thesis up front: **the envelope is a tool for binding a stable program identity to a stream that the OS/hypervisor cannot itself attribute to a program**. Anywhere the OS already names the caller better than a pubkey could, the envelope adds attack surface for no gain. Anywhere the OS names a *machine* (uid, qube name) but cannot tell us *which program inside that machine*, the envelope earns its keep.
+
+---
+
+## 1. The framework: a 2x2 of what the substrate vouches for
+
+Every transport `n_signer` supports today, or might support tomorrow, can be classified along two axes:
+
+| | Substrate names a **principal** (uid, qube, account) | Substrate does **not** name a principal |
+|---|---|---|
+| **Substrate names a specific program** | A. Both. Strongest. | (impossible — naming a program implies naming its principal) |
+| **Substrate names only a machine/account, not a program** | B. Principal-only. The "which program" gap. | C. Anonymous pipe. |
+
+- **A** is hypothetical for our context. Not even AF_UNIX gives us this — `SO_PEERCRED.pid` is UX, not identity, because PIDs are reusable and the kernel does not bind PID to executable.
+- **B** is where AF_UNIX, qrexec, and stdio-via-qrexec actually live today. We learn `uid:1000` or `qubes:foo`, but two different binaries running as the same uid in the same qube look identical.
+- **C** is plain TCP, anonymous pipes, USB serial, Bluetooth — substrates that say only "some bytes arrived from somewhere."
+
+**The auth envelope's job is to upgrade B → A and C → A** by letting the program-with-a-keypair speak for itself, on top of whatever the substrate already provides. It does *not* replace substrate identity; it composes with it.
+
+This re-framing is the whole answer to the user's question. Every transport below is just a worked example of which cell it lives in.
+
+---
+
+## 2. Per-transport verdict
+
+| Transport | Substrate identity | Cell | Envelope verdict |
+|---|---|---|---|
+| AF_UNIX (current) | `SO_PEERCRED.uid` (kernel-attested) | B | **Optional, off by default.** Adds program-level identity inside one uid; useful for multi-program desktops, redundant for single-user vault qubes. |
+| qrexec (current) | `QREXEC_REMOTE_DOMAIN` (Xen-attested) | B | **Optional, off by default, but the most interesting case.** Solves the "many tools in one caller qube share one approval row" problem and the cross-qube state continuity question. See §3. |
+| stdio (current, interactive) | inherited uid of launching shell | B | **Off.** The user is at the terminal; substrate identity is the human, and the envelope cannot improve on that. |
+| stdio (current, qrexec-launched) | `QREXEC_REMOTE_DOMAIN` from env | B | **Same as qrexec row.** stdio over qrexec is qrexec by another name. |
+| stdio (anonymous pipe, e.g. systemd socket-activated, or shelled out from a daemon) | none | C | **Required if used in production.** No principal at all otherwise. See §4. |
+| TCP (implemented v2) | peer addr (forgeable beyond loopback) | C | **Required, on every request.** Already shipped; this plan does not modify it. |
+| FIPS / serial-over-USB (planned) | device path; no principal | C | **Required.** Same reasoning as TCP — substrate provides confidentiality of the wire (in FIPS's case) but no caller identity. |
+| Bluetooth / NFC (hypothetical) | MAC address (forgeable) | C | **Required.** |
+
+The verdict column collapses to three modes — **off**, **optional** (accepted if present, ignored if absent), **required** (rejected if absent) — selectable per listener.
+
+---
+
+## 3. The qrexec story (the user's actual question)
+
+Qubes is the case where the envelope buys the most, and where it most clearly solves a problem the user has named: *"keeping state between qubes is difficult."* Two distinct sub-problems hide under that phrase. The envelope addresses one of them cleanly and the other partially.
+
+### 3.1 Sub-problem 1: many programs, one approval row
+
+A typical caller qube — say `personal` — runs nostr_terminal, a browser extension, a CLI scratch tool, and a backup script. Today they all show up to the signer as `qubes:personal`. The user approves once, and from then on **every program in that qube is a signer for that nostr_index**. There is no way to express "the browser extension may sign kind-1 events but the CLI scratch tool may not." Approval granularity is one-per-qube, which is too coarse for any caller qube that holds more than one tool.
+
+With the envelope optional-on for qrexec:
+
+- nostr_terminal in `personal` signs envelopes with its caller pubkey `Pk_term`. Browser extension signs with `Pk_ext`. The signer records *two distinct caller_ids* — `qubes:personal+pubkey:<Pk_term>` and `qubes:personal+pubkey:<Pk_ext>` (composite form, see §6) — and prompts once per program.
+- Programs that send no envelope keep the legacy `qubes:personal` identity and the legacy approval row. Backwards compatible.
+- The user gets per-program revocation: removing the approval for `Pk_ext` does not affect nostr_terminal, even though both run inside `personal`.
+
+This is the same connection-churn fix the TCP plan delivered, applied to a different ambiguity: not "same network address, different process" but "same qube, different program." The fix is identical because the underlying gap is identical — the substrate names something coarser than the unit we want to authorize.
+
+### 3.2 Sub-problem 2: state continuity between qubes
+
+In Qubes, programs that want shared identity across qubes — say a tool the user runs in both `personal` and `work`, or a tool installed in a disposable that is recreated each launch — cannot use any of the usual "save a token to disk" tricks because the qubes are separate state domains. The qrexec policy can route the call but cannot share secrets.
+
+The envelope does not magically share state across qubes — but **it makes the question well-formed**. Two patterns become available:
+
+- **Per-qube installation, distinct identity.** Tool `T` installed in `personal` generates its own keypair on first run, stored in that qube. Tool `T` in `work` generates a different keypair. The signer sees two callers; the user approves each. This is exactly what the security model wants — the qubes are *different trust domains*, so they should have different identities, full stop.
+- **Per-tool identity, shared across qubes via deliberate seed copy.** A power user who genuinely wants "the same identity for nostr_terminal in `personal` and `work`" can copy nostr_terminal's seed (or derived caller key) between the two qubes themselves, using Qubes' usual file-copy primitives. The signer then sees one caller identity from two qubes. Whether that is a good idea is a user-policy decision; the protocol simply tolerates it.
+
+The disposable-VM case is the most interesting. A disposable that re-rolls its caller keypair on every boot will re-prompt the signer every boot — which is correct behavior. *"This is a fresh untrusted environment"* is exactly what a disposable is. If the user wants disposable-but-recognized, they are asking for the per-tool seed pattern above and have to accept the tradeoff that the seed material outlives the disposable.
+
+The envelope does not solve cross-qube state by itself. What it does is **give the user a stable, signer-visible name to make their state-management decisions against** — instead of forcing every cross-qube identity question through the qube-name primitive, which is too coarse to express the question.
+
+### 3.3 Why "optional, off by default" rather than "required"
+
+Required envelopes for qrexec would break every existing caller (shell scripts, the existing client examples in [`documents/qubes_client_examples.md`](../documents/qubes_client_examples.md)) and force every Qubes caller to grow Schnorr-signing capability before it can talk to the signer. That is too high a cost for a transport whose substrate identity is already strong.
+
+Optional means:
+
+- Old callers keep working unchanged. Their `caller_id` stays `qubes:<vm>`.
+- New callers that *want* per-program approvals send envelopes and get `qubes:<vm>+pubkey:<hex>`.
+- Operators who want to enforce envelope-on-qrexec for a hardened deployment can flip a flag (`--qrexec-require-auth`).
+
+The default-off posture matches the TCP plan's principle: *give the weakest substrate the strongest application-layer identity.* qrexec is not the weakest; it is the second-strongest. It earns the upgrade only where the operator opts in.
+
+---
+
+## 4. The stdio story
+
+stdio mode in `n_signer` has three real-world spawning patterns:
+
+1. **Interactive: a user runs `nsigner --listen stdio` in a terminal and pipes a request in.** Substrate identity is the user's own uid. The user is physically present at the prompt anyway. **Envelope adds nothing.** Off.
+
+2. **qrexec service: stdio with `QREXEC_REMOTE_DOMAIN` set.** Already covered as the qrexec row in §2. Same verdict as qrexec.
+
+3. **Spawned by another program over an anonymous pipe.** Daemon `D` execs `nsigner --listen stdio` and pipes JSON-RPC over the inherited fds. The signer sees only `STDIN_FILENO`; there is no `SO_PEERCRED` (no socket), no `QREXEC_REMOTE_DOMAIN`, no peer address. Today the signer falls back to its own uid as caller_id, which is to say *the signer is its own caller* — meaningless as identity. **This is cell C.** If anyone is using this pattern, the envelope is the only available identity primitive.
+
+The third pattern is rare but not hypothetical. systemd socket-activated services, container init wrappers, and "supervisor that spawns one signer process per request" deployments all fit. Today they are silently insecure (any program in the same uid can pipe a request in and be `caller_id = uid:1000`, indistinguishable from any other). With envelope-required for anonymous-pipe stdio, the daemon must hold a keypair and identify itself, and the signer can record per-daemon approvals.
+
+The detection rule is mechanical: if the listen mode is stdio AND `QREXEC_REMOTE_DOMAIN` is unset AND `SO_PEERCRED` is unavailable on stdin (it is not a socket), classify the stream as anonymous-pipe stdio and require the envelope. Two existing pieces of code already participate in this branch: [`server_get_caller`](../src/server.c:1181) for the QREXEC env check, and the listen-mode plumbing in [`src/main.c:1043`](../src/main.c:1043).
+
+---
+
+## 5. The AF_UNIX story (briefly)
+
+AF_UNIX is the strongest substrate today and the one most likely to be misjudged. It is tempting to say "uid is enough." For single-user vault qubes it is. For shared workstations or for the per-program-revocation use case described in §3.1, it is not.
+
+The right disposition for AF_UNIX is identical to qrexec: **optional envelope, off by default, on-flag to require**. Same composite caller_id form. The only difference is that the prompt UX should still surface `pid=N (exe=/path)` from `SO_PEERCRED` as decoration alongside the npub, because on a local machine the user can `ps -p N` to verify in a way they cannot for a remote pubkey.
+
+This was [`plans/caller_token_identity.md`](caller_token_identity.md) §13 open question 5 ("should AF_UNIX accept an envelope as additional identity?") with the v2 default of "no." This document **revisits that default** and proposes "yes, but optional." See §6 and §8.
+
+---
+
+## 6. Composite caller_id form
+
+When envelope is **optional and present** on a non-TCP transport, the caller_id needs to combine substrate identity and pubkey identity. The proposed form:
+
+```
+qubes:personal+pubkey:abc123…def
+uid:1000+pubkey:abc123…def
+anon-stdio+pubkey:abc123…def      ; for case §4.3
+```
+
+Properties:
+
+- **Lexicographic prefix matches substrate-only callers.** A policy entry for `qubes:personal` does **not** match `qubes:personal+pubkey:…` — they are distinct strings, distinct rows. This is intentional: opting into envelope auth means opting into a new, separate identity, not "same identity but with extra proof."
+- **The plus character is illegal in every existing caller_id form** (uids are digits, pubkeys are hex, qube names are alphanumeric+hyphen). Using `+` as separator avoids ambiguity.
+- **Width.** `caller_id` was widened to 80 bytes in v2 of the TCP plan ([`plans/caller_token_identity.md:181`](caller_token_identity.md:181)). The composite form needs `len("qubes:") + 64 + len("+pubkey:") + 64 + 1` ≈ 144 bytes. Bumps to 160 to round.
+
+Approvals attach to the composite string. A user who approves the composite form is approving "this program *running in* this qube," not "this program anywhere" and not "this qube's anything." That is the correct semantics for the per-program-revocation use case.
+
+For TCP — where substrate identity does not exist — the form remains the bare `pubkey:<hex>` from v2. No change.
+
+---
+
+## 7. Wire-protocol changes (small)
+
+The existing envelope already carries everything needed; only the verification gate changes per transport.
+
+### 7.1 Per-listener auth posture
+
+Three settings, one per listener:
+
+| Posture | Behavior on receipt |
+|---|---|
+| `off` | `auth` field, if present, is **ignored**. caller_id is substrate-only. Default for AF_UNIX, qrexec, interactive stdio. |
+| `optional` | If `auth` is present and verifies → composite caller_id. If `auth` is absent → substrate-only caller_id. If `auth` is present and fails verification → reject. Operator opt-in for AF_UNIX/qrexec/stdio. |
+| `required` | `auth` must be present and verify. Default for TCP, FIPS-serial, anonymous-pipe stdio. |
+
+CLI plumbing extends what the TCP plan already added:
+
+```
+--listen unix --auth off            # default
+--listen unix --auth optional
+--listen qrexec --auth optional
+--listen stdio --auth required      # for anon-pipe deployments
+--listen tcp:... --auth required    # only legal value for tcp; kept explicit
+```
+
+The auth-skew-seconds and nonce cache are listener-context state; they already exist in `server_ctx_t` from v2 and are reused unmodified.
+
+### 7.2 The envelope itself: zero changes
+
+Same kind 27235, same three required tags, same JCS body hash, same Schnorr verification primitive [`nostr_verify_event_signature`](../resources/nostr_core_lib/nostr_core/nip001.h:20). A client that signs envelopes for TCP today can sign them for qrexec tomorrow with no code change. This is the single most important property of the proposal — it preserves the v2 envelope as a portable, transport-independent artifact.
+
+### 7.3 Replay cache scoping
+
+One subtle question: is the nonce cache per-listener or process-global? Process-global is simpler and strictly stricter (an envelope replayed across two listeners is also rejected). Per-listener is more permissive but has no real attack-model justification. **Default: process-global**, unchanged from v2.
+
+---
+
+## 8. Decision matrix and recommended defaults
+
+| Transport | Default posture | Operator can flip to | Rationale |
+|---|---|---|---|
+| AF_UNIX | off | optional, required | uid is strong; envelope is for power users who need per-program granularity. |
+| qrexec | off | optional, required | qube is strong; envelope solves §3.1 for users who hit it. |
+| stdio (interactive) | off | (locked off) | Envelope cannot improve on a human at the terminal. |
+| stdio (qrexec-launched) | inherits qrexec posture | (inherits) | Same substrate. |
+| stdio (anonymous pipe) | required | (locked required) | No substrate identity exists; refusing is the only safe default. |
+| TCP | required | (locked required) | Already v2 default. Unchanged. |
+| FIPS / USB-serial (planned) | required | (locked required) | Same as TCP — wire identity is fictional. |
+
+"Locked" rows reflect transports where flipping the posture would re-introduce the gap the envelope was designed to close, and the CLI rejects the change.
+
+---
+
+## 9. Implementation order
+
+Each step is independently mergeable, gated behind the per-listener `--auth` flag default of `off` for the new transports so existing callers see no behavior change.
+
+1. **Refactor: lift the v2 auth gate out of the TCP-specific branch in [`server_handle_one`](../src/server.c:1192) into a transport-agnostic helper** parameterized by posture. No semantic change yet; TCP listener still passes `required`.
+2. **Add the `--auth {off|optional|required}` CLI flag** with per-listener storage on `server_ctx_t`. Default off for unix/qrexec, required for tcp, off-locked for interactive stdio, required-locked for anonymous-pipe stdio.
+3. **Add anonymous-pipe-stdio detection.** In [`server_get_caller`](../src/server.c:1181), when listen mode is stdio and `QREXEC_REMOTE_DOMAIN` is unset, probe `SO_PEERCRED` on stdin; on failure mark the stream as anonymous-pipe and require auth.
+4. **Composite caller_id format** in [`caller_identity_t`](../src/server.c:404). Widen to 160. Add a small helper `caller_id_compose(buf, sz, substrate_kind, substrate_value, pubkey_hex)`.
+5. **`--preapprove` extension.** Accept the composite form (`caller=qubes:personal+pubkey:<hex>`, `caller=uid:1000+pubkey:<hex>`). Existing forms stay valid.
+6. **Tests.**
+   - Optional-mode AF_UNIX accepting both with-envelope and without-envelope requests, producing two distinct caller_ids.
+   - Optional-mode qrexec with two distinct pubkeys from one source qube → two prompts, two approvals, independent revocation.
+   - Anonymous-pipe-stdio rejects no-envelope requests with code 2014.
+   - TCP behavior unchanged (regression check on v2).
+7. **Documentation.**
+   - [`documents/SECURITY.md`](../documents/SECURITY.md) §3 identity table: add the composite kinds; clarify that envelope is now a portable identity layer, not a TCP-only feature.
+   - [`documents/QUBES_OS.md`](../documents/QUBES_OS.md): add a §3.4 on per-program identity within a qube and the disposable-VM tradeoff.
+   - [`documents/CLIENT_IMPLEMENTATION.md`](../documents/CLIENT_IMPLEMENTATION.md): note that any client may attach an envelope on any transport; the signer's posture decides whether it is honored or required.
+
+## 10. What this plan deliberately does not do
+
+- **Does not change TCP behavior.** The v2 contract on TCP — required envelope, every request — is preserved exactly.
+- **Does not introduce a new envelope format, kind, or canonicalization.** Reuses kind 27235 and the JCS body-hash rule from v2 verbatim.
+- **Does not propose persistent state** anywhere. Approvals stay in RAM; no caller registry on disk; the §1 "crash equals total wipe" property of [`documents/SECURITY.md:19`](../documents/SECURITY.md:19) is unchanged.
+- **Does not invent an answer to cross-qube state continuity.** It articulates the question and gives the user a primitive (a stable pubkey-named caller) against which to make their own state decisions.
+- **Does not add transport encryption** for any substrate. Confidentiality is the substrate's job (FIPS, qrexec, AF_UNIX with abstract namespace, loopback). The envelope is auth, not encryption.
+
+## 11. Open questions for review
+
+1. **Is the composite caller_id form (`substrate+pubkey:...`) the right disposition, or should the envelope, when present, *override* substrate identity entirely (replacing rather than composing)?** The override form is simpler — one identity, not two — but it discards information the user might want (the npub is verified; the qube name is hypervisor-attested; both data points are useful at the prompt). Default: compose.
+2. **Should anonymous-pipe stdio be required or rejected outright?** A reasonable case can be made that `nsigner --listen stdio` over a non-tty, non-socket fd is just *misuse* and should refuse to start rather than silently demand envelopes. Default: require envelope; allow operator to disable the listen mode entirely if undesired.
+3. **Should the `--auth optional` setting on AF_UNIX/qrexec be a per-listener flag (today's proposal) or per-method (e.g. envelope required for `sign_event` but not for `get_public_key`)?** Per-method adds policy surface for limited gain; substrate identity is already the per-method gate via the existing role table. Default: per-listener only.
+4. **Does the v2 nonce cache size of 1024 still suffice when up to four listeners may share it?** Yes — the bound is "envelopes per skew window," not "listeners." Confirmed sufficient. No change.
+5. **Should `qubes:<vm>+pubkey:<hex>` and `pubkey:<hex>` (TCP) for the same pubkey be considered the same caller for `--preapprove` convenience?** No. They are different identities by construction (different substrates, different threat models). An operator who wants both pre-approved writes both lines. Default: keep them distinct.
+
+---
+
+## Appendix A — Mermaid: revised per-transport decision tree
+
+```mermaid
+flowchart TD
+    A[Request arrives on a listener] --> B{listener auth posture}
+    B -- off --> C[ignore any auth field]
+    C --> D[caller_id = substrate-only]
+    B -- optional --> E{auth field present?}
+    E -- no --> D
+    E -- yes --> F[verify envelope per v2 rules]
+    F -- fail --> G[reject 2010-2017]
+    F -- ok --> H[caller_id = substrate + pubkey:hex]
+    B -- required --> I{auth field present?}
+    I -- no --> J[reject 2014 auth_envelope_required]
+    I -- yes --> F
+    D --> K[normal policy_check]
+    H --> K
+    K --> L{verdict}
+    L -- ALLOW --> M[dispatch RPC]
+    L -- DENY --> N[2001 policy_denied]
+    L -- PROMPT --> O[approve / save / register caller_id]
+    O --> M
+```
+
+## Appendix B — Worked example: per-program identity inside a qube
+
+Caller qube `personal` runs two tools:
+
+- nostr_terminal, holding caller key `Pk_term`.
+- A custom shell script, no keypair.
+
+Operator starts the signer with:
+
+```
+nsigner --listen qrexec --auth optional \
+  --preapprove caller=qubes:personal+pubkey:Pk_term,role=main
+```
+
+First request from nostr_terminal carries an envelope signed by `Pk_term`. Signer verifies, builds caller_id `qubes:personal+pubkey:Pk_term`, hits the pre-approval, signs without prompting.
+
+First request from the shell script carries no envelope. Signer skips verification, builds caller_id `qubes:personal`, finds no approval, prompts the user. User can approve `[a]` for the shell script independently of nostr_terminal.
+
+Later, the user wants to revoke the shell script's access (a future TUI hotkey). They remove the `qubes:personal` row. nostr_terminal continues to work because its row `qubes:personal+pubkey:Pk_term` is untouched. **Per-program revocation, achieved without any change to qrexec policy or the qube boundary.**
+
+This is the concrete answer to the user's "is this useful for other transports" question — yes, in qrexec specifically, where it converts qube-granularity approvals into program-granularity approvals while leaving the qube boundary itself unchanged.

plans/caller_token_identity.md

@@ -0,0 +1,483 @@
+# Plan: Caller-pubkey identity with required Schnorr authentication for URL/TCP
+
+Status: **draft v2 — for review**
+
+> **History.** Draft v1 of this document proposed a random 32-byte bearer token persisted to a `0600` file on both ends. That draft was rejected on two grounds: (1) it violated [`documents/SECURITY.md:19`](../documents/SECURITY.md:19) — "Crash equals total wipe" — by writing tokens to disk, and (2) bearer credentials over a transport already chosen as the *least* trusted is the wrong security gradient. v2 replaces the bearer token with a Schnorr-authenticated public key, removes all disk persistence, and requires cryptographic proof-of-possession on every TCP/URL request from day one.
+
+This plan addresses the same originating bug — every TCP reconnect re-fires the approval prompt because `caller_id` is built from the ephemeral `addr:port` pair — but does so by giving the weakest transport the strongest application-layer identity, not the weakest. AF_UNIX and qrexec retain their existing kernel- and hypervisor-vouched identities; TCP/URL gains BIP-340 Schnorr authentication using primitives the signer already links.
+
+---
+
+## 1. Goals
+
+1. **One approval per program-keypair, not per TCP connection.** Two requests carrying the same `caller_pubkey` resolve to the same policy entry regardless of source port, transport jitter, or reconnect.
+2. **Cryptographic proof-of-possession on every TCP/URL request.** The wire identity is not just a name; it is backed by a signature that only the holder of the corresponding private key can produce.
+3. **Replay-resistant within a bounded window.** A captured request cannot be replayed against the signer indefinitely.
+4. **No disk persistence — anywhere.** No tokens on disk, no caller registry on disk, no policy on disk. "Crash equals total wipe" applies to this feature unmodified.
+5. **Stronger transports keep their stronger primitives.** AF_UNIX still uses `SO_PEERCRED`; qrexec still uses `QREXEC_REMOTE_DOMAIN`. Neither acquires a new spoofable claim field, and neither is required to send signatures.
+6. **Use only `nostr_core_lib` and existing dependencies.** No new crypto libraries. No new hash functions. The auth envelope is a Nostr event, verified by a primitive [`nostr_verify_event_signature`](../resources/nostr_core_lib/nostr_core/nip001.h:20) the signer already trusts.
+
+## 2. Non-goals
+
+- **No transport-level encryption / TLS.** FIPS still provides confidentiality of the substrate. Application-layer auth and transport encryption are separate concerns.
+- **No mutual authentication of the signer to the client.** This plan authenticates the client to the signer. The reverse direction is future work and intentionally out of scope.
+- **No persistence of any state.** Approvals stay in RAM. A signer restart re-prompts every caller exactly once. A client restart re-prompts itself once if it lost its in-memory keypair, or zero times if the client retains its own identity in its own memory.
+- **No new transports.** AF_UNIX, qrexec, stdio, TCP unchanged at the socket layer.
+- **No PID-as-identity.** Documented rejection in §10.
+- **No bearer tokens.** Explicit reversal of v1.
+- **No change to the deny-by-default rule.** A new pubkey shows up exactly once at the prompt; everything in [`plans/deny_by_default_approvals.md`](deny_by_default_approvals.md) applies unchanged.
+
+## 3. The model in one paragraph
+
+For TCP/URL transport, every JSON-RPC request must carry an **auth envelope** — a small Nostr-shaped event signed by the caller's private key. The signer verifies that signature with [`nostr_verify_event_signature`](../resources/nostr_core_lib/nostr_core/nip001.h:20) before any policy logic runs. The verified `pubkey` field becomes the `caller_id` for that request (`pubkey:<hex>` form), feeding straight into the existing policy table that already handles `uid:1000`, `qubes:foo`, `tcp:[addr]:port`. On first contact for a given pubkey, the existing deny-by-default prompt fires; the user sees the npub, an optional client-supplied label, and the verb/role; on `[a]` the pubkey is recorded as an approval entry the same way any other caller is. Subsequent requests from the same pubkey hit the approval and are served silently. AF_UNIX and qrexec are unaffected — they continue to use kernel/hypervisor identity and ignore any auth envelope they receive. Nothing is written to disk on either side at any point.
+
+## 4. Concept additions to the existing model
+
+[`documents/SECURITY.md:57`](../documents/SECURITY.md:57) defines three concepts: identity, index, approval. This plan adds nothing visible to the user beyond an alternate identity *kind*. There is no fourth concept. Specifically:
+
+- A **pubkey-identified caller** is a new identity kind, alongside `unix_peer`, `qubes`, `tcp_local`, `tcp_remote`. Its `caller_id` form is `pubkey:<64 hex chars>`.
+- An **auth envelope** is a wire-protocol artifact, not a user-facing concept. The user never sees the word "envelope"; they see "caller: npub1abc…xyz" at the prompt.
+- An **approval** is unchanged: the same `(caller_id, role) → PROMPT_NEVER` row in the same in-memory policy table.
+
+The only document-level change is that [`documents/SECURITY.md`](../documents/SECURITY.md) §11's "tcp_remote (planned)" and "fips (planned)" rows ([`documents/SECURITY.md:98-99`](../documents/SECURITY.md:98)) become "implemented; identity = caller pubkey verified by Schnorr signature."
+
+## 5. Per-transport identity primitives — the unified picture
+
+| Transport | Identity primitive | Validation | `caller_id` form | Auth envelope required? |
+|---|---|---|---|---|
+| AF_UNIX | `SO_PEERCRED.uid` (and `pid` for UX) | Kernel-attested. | `uid:<n>` | **No.** Kernel vouches. |
+| qrexec | `QREXEC_REMOTE_DOMAIN` | Hypervisor-attested. | `qubes:<vm>` | **No.** Xen vouches. |
+| stdio | inherited environment (qrexec or interactive) | As above. | `qubes:<vm>` or `uid:<n>` | **No.** |
+| TCP / FIPS | `caller_pubkey` from auth envelope | BIP-340 Schnorr signature verified by `nostr_verify_event_signature`. | `pubkey:<hex>` | **Yes. Required on every request.** |
+
+A TCP request that arrives **without** a valid auth envelope is rejected before any policy logic runs. There is no fallback to `tcp:[addr]:port` identity; v2 retires that form entirely for the TCP listener. Operators who relied on `--preapprove caller=tcp:...` must migrate to `--preapprove caller=pubkey:<hex>` (see §7.5).
+
+## 6. Wire protocol: the auth envelope
+
+### 6.1 Shape
+
+The auth envelope is a single JSON object placed at the top level of the request, alongside (not inside) `method`/`params`. It is structured exactly like a NIP-01 Nostr event so that [`nostr_verify_event_signature`](../resources/nostr_core_lib/nostr_core/nip001.h:20) verifies it directly with no custom canonicalization code on the signer side:
+
+```json
+{
+  "id": "rpc-42",
+  "method": "sign_event",
+  "params": { ... },
+  "auth": {
+    "id":         "<32-byte event id, hex>",
+    "pubkey":     "<32-byte x-only secp256k1 pubkey, hex>",
+    "created_at": 1730000000,
+    "kind":       27235,
+    "tags":       [
+      ["nsigner_rpc", "rpc-42"],
+      ["nsigner_method", "sign_event"],
+      ["nsigner_body_hash", "<sha256(canonical body), hex>"]
+    ],
+    "content":    "<optional client label, e.g. \"nostr_terminal@laptop\">",
+    "sig":        "<64-byte Schnorr signature, hex>"
+  }
+}
+```
+
+The `kind` value `27235` is the same kind NIP-42 uses for client authentication to relays. We are explicitly piggybacking on that semantic: this is "client authenticates to a service it wants to use," and reusing the existing kind keeps us inside Nostr conventions rather than inventing a new event kind. The signer accepts kind 27235 events whose tag set marks them as nsigner-bound.
+
+### 6.2 Required tags
+
+Three tags are required on every envelope. The signer rejects envelopes missing any of them with `auth_envelope_malformed` (code 2010).
+
+| Tag name | Value | Purpose |
+|---|---|---|
+| `nsigner_rpc` | The request's `id` field, copied verbatim. | Binds the signature to this specific request id; a captured envelope cannot be reused with a different request id. |
+| `nsigner_method` | The request's `method` field, copied verbatim. | Binds the signature to the verb. A captured `get_public_key` envelope cannot be replayed as `sign_event`. |
+| `nsigner_body_hash` | Hex SHA-256 of the canonicalized `params` object — see §6.3. | Binds the signature to the request payload. The signer recomputes this hash and rejects on mismatch with `auth_body_mismatch` (code 2011). |
+
+### 6.3 Canonicalization of `params`
+
+To make `nsigner_body_hash` deterministic across implementations, `params` must be hashed in a single canonical form. To avoid inventing a new canonicalizer, we adopt **JCS** (RFC 8785, JSON Canonicalization Scheme) — the same canonicalization Nostr already uses for event IDs in NIP-01. The body hash is `SHA-256(JCS(params))`, computed by both client and signer using [`nostr_sha256`](../resources/nostr_core_lib/nostr_core/utils.h:46).
+
+If `params` is absent from the request, `nsigner_body_hash` is `SHA-256("null")` (the canonicalization of JSON `null`), which is a fixed 64-char constant the signer can use without per-request hashing for the no-params case.
+
+### 6.4 Signature verification
+
+On receipt of a TCP request, the signer:
+
+1. Extracts the `auth` object. If absent, reject with `auth_envelope_required` (code 2014).
+2. Validates the envelope is structurally a NIP-01 event (id is sha256 of canonical event header; `pubkey`, `sig`, `created_at`, `kind`, `tags`, `content` present and well-typed). Library function [`nostr_validate_event_structure`](../resources/nostr_core_lib/nostr_core/nip001.h:19) handles this.
+3. Verifies the Schnorr signature: [`nostr_verify_event_signature(auth_event)`](../resources/nostr_core_lib/nostr_core/nip001.h:20). Reject with `auth_signature_invalid` (code 2012) on failure.
+4. Checks `kind == 27235`. Reject with `auth_kind_invalid` (code 2013) otherwise.
+5. Confirms `nsigner_rpc` tag matches request `id` and `nsigner_method` tag matches request `method`. Reject with `auth_envelope_mismatch` (code 2015) on either mismatch.
+6. Computes `SHA-256(JCS(params))` and confirms it matches `nsigner_body_hash`. Reject with `auth_body_mismatch` (code 2011) on mismatch.
+7. Applies replay protection — see §6.5.
+8. On success, sets `caller.caller_id = "pubkey:" + hex(pubkey)`. Policy lookup proceeds against this caller_id.
+
+### 6.5 Replay protection
+
+Two layered defenses, neither requiring disk:
+
+#### 6.5.1 Timestamp window
+
+`auth.created_at` must satisfy `|now - created_at| <= AUTH_CLOCK_SKEW_SEC`. Default `AUTH_CLOCK_SKEW_SEC = 30`. Configurable via `--auth-skew-seconds` at startup. Reject with `auth_envelope_stale` (code 2016) if outside the window.
+
+The 30-second window is small enough that a captured envelope is a poor reuse target and large enough to tolerate ordinary clock drift in the FIPS-mediated path. Operators with looser requirements can widen it; operators with NTP-locked deployments can narrow it.
+
+#### 6.5.2 Nonce / id cache
+
+The signer maintains an in-memory ring buffer of recently-seen `auth.id` values:
+
+```c
+#define AUTH_NONCE_CACHE_SIZE 1024
+typedef struct {
+    uint8_t  id[32];
+    uint64_t seen_at;        /* monotonic seconds */
+} auth_nonce_entry_t;
+
+typedef struct {
+    auth_nonce_entry_t entries[AUTH_NONCE_CACHE_SIZE];
+    int head;
+    int count;
+} auth_nonce_cache_t;
+```
+
+On verified envelope, the signer linearly scans the cache for `auth.id`. If found, reject with `auth_replay_detected` (code 2017). If not, insert at head, evicting the tail if full.
+
+The cache size of 1024 paired with the 30-second window means at sustained 33+ requests/second from any caller would push older entries out before they expire — at which point the timestamp window catches the replay anyway. The two defenses overlap intentionally: the cache catches fast replays inside the window; the timestamp catches slow replays outside it.
+
+The cache is purely in-memory. On signer restart it starts empty, which is safe because the timestamp window also resets the universe of acceptable envelopes — any envelope created before the restart is now outside the window and would be rejected on `created_at` grounds before reaching the nonce check.
+
+### 6.6 Error codes added
+
+| Code | Symbolic name | Meaning |
+|---|---|---|
+| 2010 | `auth_envelope_malformed` | Required field or tag missing / wrong type. |
+| 2011 | `auth_body_mismatch` | `nsigner_body_hash` did not match recomputed hash of `params`. |
+| 2012 | `auth_signature_invalid` | Schnorr verification failed. |
+| 2013 | `auth_kind_invalid` | Auth event kind ≠ 27235. |
+| 2014 | `auth_envelope_required` | TCP request arrived with no `auth` object. |
+| 2015 | `auth_envelope_mismatch` | `nsigner_rpc` or `nsigner_method` tag did not match request envelope. |
+| 2016 | `auth_envelope_stale` | `created_at` outside skew window. |
+| 2017 | `auth_replay_detected` | `auth.id` already seen in nonce cache. |
+
+These are placed in their own contiguous range so client code can identify "auth-layer error → bug in my signing code" vs "policy-layer error → user denied."
+
+## 7. Signer-side data model and code changes
+
+### 7.1 Extension to `caller_identity_t`
+
+[`src/server.c:404`](../src/server.c:404) currently has:
+
+```c
+typedef struct {
+    int kind;
+    char caller_id[64];
+    char source_qube[64];
+} caller_identity_t;
+```
+
+Becomes:
+
+```c
+typedef struct {
+    int     kind;
+    char    caller_id[80];                /* widened: "pubkey:" + 64 hex + NUL fits */
+    char    source_qube[64];
+    /* Filled in only when an auth envelope was verified on this request. */
+    int     auth_present;                 /* 0 or 1 */
+    uint8_t auth_pubkey[32];              /* present iff auth_present */
+    char    auth_label[64];               /* envelope `content` field, sanitized */
+    /* UX context, never used as policy key. */
+    pid_t   peer_pid;                     /* SO_PEERCRED.pid for AF_UNIX, else 0 */
+    char    peer_addr[64];                /* tcp:[...]:port, used in prompt context */
+} caller_identity_t;
+```
+
+The widened `caller_id` ripples through every translation unit's headerless declaration block. Mechanical change.
+
+### 7.2 New translation unit: `src/auth_envelope.c`
+
+A new file owns auth-envelope parsing, verification, and the nonce cache. Public surface:
+
+```c
+typedef enum {
+    AUTH_OK = 0,
+    AUTH_ERR_MALFORMED,
+    AUTH_ERR_BODY_MISMATCH,
+    AUTH_ERR_SIG_INVALID,
+    AUTH_ERR_KIND_INVALID,
+    AUTH_ERR_REQUIRED,
+    AUTH_ERR_TAG_MISMATCH,
+    AUTH_ERR_STALE,
+    AUTH_ERR_REPLAY
+} auth_result_t;
+
+/* Verify the auth envelope embedded in `request_root` against the request's
+ * id, method, and params. On AUTH_OK, fills caller->auth_pubkey and
+ * caller->auth_label. Does not touch caller_id. */
+auth_result_t auth_envelope_verify(cJSON *request_root,
+                                   auth_nonce_cache_t *nonce_cache,
+                                   int skew_seconds,
+                                   uint64_t now_unix,
+                                   caller_identity_t *caller);
+
+void auth_nonce_cache_init(auth_nonce_cache_t *cache);
+```
+
+The implementation is thin: extract `auth` cJSON object, run library validations, run our tag/body/replay checks, return. All the heavy crypto lifting is `nostr_verify_event_signature`.
+
+A corresponding [`tests/test_auth_envelope.c`](../tests/test_auth_envelope.c) covers the eight error paths with hand-crafted envelopes (using a fixed test keypair) and the happy path.
+
+### 7.3 Ordering in `server_handle_one`
+
+[`src/server.c:1192`](../src/server.c:1192) gains an auth gate between framed-receive and selector-resolve, but only on TCP. Pseudocode for the revised flow:
+
+```
+1. accept(); server_get_caller(fd, &caller);  /* unchanged: kind, peer_addr */
+2. transport_recv_framed(fd, &request);
+3. if (caller.kind == NSIGNER_LISTEN_TCP) {
+       parse request as cJSON;
+       auth_result = auth_envelope_verify(root, &ctx->nonce_cache,
+                                          ctx->auth_skew, now, &caller);
+       if (auth_result != AUTH_OK) { send error 2010-2017; close; return; }
+       snprintf(caller.caller_id, ..., "pubkey:%s", hex(caller.auth_pubkey));
+   }
+   /* AF_UNIX/qrexec: caller.caller_id already set; auth envelope, if any,
+      is silently ignored. */
+4. extract method + selector;  /* unchanged */
+5. resolve role;               /* unchanged */
+6. policy_check(caller.caller_id, ...);  /* unchanged */
+7. prompt if PROMPT;            /* unchanged */
+8. dispatch;                   /* unchanged */
+```
+
+The auth gate is a single function call. Existing code paths are touched only at the point where `caller.caller_id` is overwritten on success.
+
+### 7.4 Server context additions
+
+[`server_ctx_t`](../src/server.c) gains:
+
+```c
+auth_nonce_cache_t nonce_cache;   /* in-memory, zeroed at startup, never persisted */
+int auth_skew_seconds;            /* default 30, settable via --auth-skew-seconds */
+```
+
+### 7.5 `--preapprove` extension
+
+[`parse_preapprove_spec`](../src/policy.c:553) gains a new caller form:
+
+```
+--preapprove caller=pubkey:<64 hex>,role=main
+--preapprove caller=pubkey:<64 hex>,nostr_index=1
+```
+
+The pubkey is the **client's** caller pubkey — a 32-byte x-only secp256k1 hex value. No file reference; the operator has the pubkey directly. There is no `pubkey_file` form because the pubkey is not secret and embedding it in the unit file is fine.
+
+The `tcp:` caller form is **deprecated** for the TCP listener (not removed; AF_UNIX and qrexec preapprovals are unaffected — they never used `tcp:`). On a `--preapprove caller=tcp:...` for a TCP listener, the signer prints a deprecation warning at startup explaining that TCP requests now require auth envelopes and the entry will never match. This is documented in [`documents/N_OS_TR_AGENT_CHANGES.md`](../documents/N_OS_TR_AGENT_CHANGES.md).
+
+### 7.6 No persistence — confirmed property
+
+This plan introduces:
+- An in-memory `caller_identity_t` per request (already exists; widened).
+- An in-memory `auth_nonce_cache_t` per server context (new, ring buffer, RAM only).
+- New entries in the existing in-memory `policy_table_t` keyed on `pubkey:<hex>` (no schema change).
+
+It does **not** introduce:
+- Any file written by the signer.
+- Any file required at startup by the signer (beyond the already-required mnemonic input).
+- Any state that survives `server_stop`.
+
+"Crash equals total wipe" remains literally true.
+
+## 8. Client-side requirements (e.g. nostr_terminal)
+
+### 8.1 Caller keypair
+
+The client needs a secp256k1 keypair for the purpose of authenticating to n_signer. Three sourcing strategies are supported, and the choice is the client's:
+
+1. **Reuse the program's existing Nostr identity.** A program like nostr_terminal that already has a published Nostr pubkey can use that same keypair as its caller identity. The user sees a familiar npub at the prompt and recognizes "yes, that's nostr_terminal's pubkey."
+2. **Derive a dedicated caller identity from the program's seed.** A program with a stored seed can derive a separate `m/44'/1237'/<n>'/0/<m>` key as a stable "RPC client identity" distinct from its public posting key. The user sees a unique-to-the-program-installation npub.
+3. **Generate ephemerally per session.** A program that has no persistent identity at all generates a fresh secp256k1 key in memory at startup. Each client restart yields a new key, and the user re-prompts once per restart. This is the slowest UX but the simplest implementation.
+
+n_signer does not know or care which strategy a client uses. The pubkey on the wire is the only thing the signer sees.
+
+### 8.2 Signing each request
+
+For every TCP request, the client:
+
+1. Builds the regular JSON-RPC envelope (`id`, `method`, `params`).
+2. Computes `body_hash = SHA-256(JCS(params))`.
+3. Constructs an auth event with kind 27235, the three required tags, optional `content` label, current `created_at`.
+4. Signs the event with its private key (BIP-340 Schnorr — for nostr_terminal this is the same `nostr_schnorr_sign`-style call it already uses for kind-1 events, just with a different kind and tag set).
+5. Embeds the signed event under an `auth` field in the request.
+6. Sends the framed bytes.
+
+The signing operation is bounded — one Schnorr sign per RPC. Modern hardware does this in microseconds. Implementations should not cache or skip signing; the per-request `created_at` is what makes the nonce defense meaningful.
+
+### 8.3 Reconnect behavior — the bug being fixed
+
+- TCP socket drops mid-session → client reconnects → next RPC carries a fresh auth envelope (different `id`, different `created_at`) signed by the same pubkey.
+- Signer verifies envelope, computes the same `caller_id = "pubkey:<hex>"`, finds the existing approval entry, serves silently. **No prompt.**
+- Signer process restart → policy table empties → next RPC's envelope verifies fine but the policy entry is gone → user re-prompts once per pubkey, picks `[a]`, future requests served silently. **One prompt per signer restart, exactly as for any other caller kind.**
+- Client process restart → if the client persisted its keypair (its own choice), zero prompts. If the client used an ephemeral keypair, one prompt for the new pubkey.
+
+### 8.4 Replay-window awareness
+
+Clients must keep their clock synced within `AUTH_CLOCK_SKEW_SEC` (default 30s). This is normally trivial via NTP. The signer's response on stale-clock errors (`auth_envelope_stale`, code 2016) tells the client to fix its clock; clients should surface this clearly rather than retrying.
+
+### 8.5 No on-disk requirement
+
+The client is **not required** to store anything on disk. Whether it does is the client's policy. n_signer's plan imposes no client-side filesystem state.
+
+## 9. Mermaid: TCP request decision tree
+
+```mermaid
+flowchart TD
+    A[TCP request arrives] --> B[parse JSON, extract auth]
+    B --> C{auth present?}
+    C -- no --> D[reject 2014 auth_envelope_required]
+    C -- yes --> E[validate event structure]
+    E -- bad --> F[reject 2010 auth_envelope_malformed]
+    E -- ok --> G[verify Schnorr signature]
+    G -- bad --> H[reject 2012 auth_signature_invalid]
+    G -- ok --> I{kind == 27235?}
+    I -- no --> J[reject 2013 auth_kind_invalid]
+    I -- yes --> K{tags match request id and method?}
+    K -- no --> L[reject 2015 auth_envelope_mismatch]
+    K -- yes --> M{body hash matches?}
+    M -- no --> N[reject 2011 auth_body_mismatch]
+    M -- yes --> O{within skew window?}
+    O -- no --> P[reject 2016 auth_envelope_stale]
+    O -- yes --> Q{auth.id in nonce cache?}
+    Q -- yes --> R[reject 2017 auth_replay_detected]
+    Q -- no --> S[insert nonce, set caller_id pubkey:hex]
+    S --> T[normal policy_check pipeline]
+    T --> U{verdict}
+    U -- ALLOW --> V[dispatch RPC]
+    U -- DENY --> W[2001 policy_denied]
+    U -- PROMPT --> X[user approves with a, registers caller]
+    X --> V
+```
+
+## 10. Identity primitives compared
+
+| Primitive | Stable across reconnects | Forgeable on TCP/FIPS | Survives client restart | Replay-resistant | n_signer dependency added |
+|---|---|---|---|---|---|
+| `tcp:[addr]:port` (today) | **No** | n/a (it is the address) | n/a | n/a | none |
+| PID claimed in JSON | Yes | **Yes** — any client claims any int | n/a | No | none |
+| 32-byte random bearer token (v1 of this plan) | Yes | Yes if leaked from disk or wire | Only if disk-persisted (rejected) | No | none |
+| **Caller pubkey + Schnorr signature (this plan)** | **Yes** | **No** — signature attests possession | Yes if client retains key (its choice) | Yes (nonce + skew window) | none — `nostr_core_lib` already linked |
+
+The bottom row is the only one that satisfies all four columns and adds zero new transitive dependencies. PID and the v1 token are kept in the table as documentation of why we are not doing them.
+
+PID retains a single legitimate use: **prompt UX context for AF_UNIX**. When the signer can read PID via `SO_PEERCRED`, it is displayed in the approval prompt as `pid=18437 (exe=/usr/local/bin/nostr_terminal)` so the user can `ps -p 18437` and verify. PID is never the policy key.
+
+## 11. Threats addressed and not addressed
+
+### Addressed
+
+- **Connection-churn re-prompting.** The originating bug. One pubkey, one approval.
+- **Same-IP, different-program ambiguity.** Two programs from the same FIPS endpoint hold different keypairs and produce distinct, verified `pubkey:` caller_ids.
+- **Drive-by signing from a process that lacks the privkey.** A network adversary or local-but-unauthorized process cannot forge envelopes. Wire knowledge of the pubkey is non-sensitive; the privkey never leaves the legitimate client's memory.
+- **Replay of captured envelopes.** Bounded by `AUTH_CLOCK_SKEW_SEC` and the in-memory nonce cache.
+- **Tampered request bodies.** `nsigner_body_hash` covers `params`, so a man-in-the-middle who flips a kind-1 request to a kind-30000 request invalidates the signature and is rejected.
+- **Tampered request methods or ids.** Covered by required tags `nsigner_method` and `nsigner_rpc`.
+
+### Not addressed (explicit)
+
+- **A local attacker who reads the client's privkey out of process memory.** They become the registered caller. This is the same threat as today's same-uid trust model and is handled by the OS, not by n_signer.
+- **A network attacker who can both passively observe AND inject AND has compromised the FIPS substrate.** Without TLS at the n_signer layer, transport encryption is FIPS's job. If FIPS confidentiality is broken, the attacker can read envelopes — but they still cannot forge them (no privkey) and they cannot replay them outside the skew window. Confidentiality of `params` is a separate concern from auth.
+- **Signer authenticating to the client.** This plan does the client → signer direction. Signer → client auth is future work; today the client trusts whichever endpoint the operator pointed it at.
+- **Long-term key rotation policy.** Operators rotate by removing the old approval entry (TUI hotkey, future) and prompting the new pubkey. There is no automatic rotation.
+
+## 12. Implementation order (suggested)
+
+Each step is independently testable.
+
+1. **`src/auth_envelope.c` and `tests/test_auth_envelope.c`.** Pure data-structure and crypto wrapper around `nostr_validate_event_structure` + `nostr_verify_event_signature` + tag/body/timestamp/nonce checks. No transport coupling. Test with hand-crafted JSON and fixed test keypairs.
+2. **Nonce cache primitive.** Ring buffer; trivial unit tests for insert / lookup / eviction.
+3. **`caller_identity_t` widening.** Mechanical change across all `NSIGNER_HEADERLESS_DECLS_BEGIN` blocks. Compile-only step; existing tests should still pass.
+4. **Auth gate in `server_handle_one`.** Hook (1) into the request flow at TCP transport. Add the eight new error code responses. Integration test: fire a TCP request without `auth` and confirm rejection with code 2014; fire one with a valid envelope and confirm normal flow.
+5. **`--preapprove caller=pubkey:<hex>` parsing.** Extension to [`parse_preapprove_spec`](../src/policy.c:553).
+6. **`--auth-skew-seconds` flag.** Plumbing.
+7. **Documentation.**
+   - [`documents/SECURITY.md`](../documents/SECURITY.md): replace `tcp_remote (planned)` and `fips (planned)` rows in §11 with the verified-pubkey description; add a section on the auth envelope.
+   - [`documents/CLIENT_IMPLEMENTATION.md`](../documents/CLIENT_IMPLEMENTATION.md): full chapter on the auth envelope, JCS canonicalization rule, the eight error codes, a concrete signing example.
+   - [`documents/FIPS_DEPLOYMENT.md`](../documents/FIPS_DEPLOYMENT.md): note that TCP requests now require auth envelopes; update the deployment checklist; remove the "remote TCP mode only with mandatory TLS + authenticated caller key flow" future-work note since this plan delivers the second half.
+   - [`documents/N_OS_TR_AGENT_CHANGES.md`](../documents/N_OS_TR_AGENT_CHANGES.md): example with `--preapprove caller=pubkey:<hex>`.
+8. **Deprecation handling for `--preapprove caller=tcp:...` on TCP listeners.** Warning at startup; entries effectively dead.
+9. **TUI revocation hotkey.** UX-side, can land later.
+
+## 13. Open questions for review
+
+These are the judgment calls left in v2. None of them block the v2 → implementation move; defaults are stated for each.
+
+1. **Skew window default.** This plan says 30 seconds. Confirm. Tighter (5s) means fewer replay opportunities but more clock-drift errors; looser (120s) the reverse.
+2. **Nonce cache size.** This plan says 1024. With a 30s window that handles ~33 RPS sustained per signer, far above realistic load. Confirm the size is fine.
+3. **Should the auth envelope's `content` field carry a label?** This plan says yes, displayed at prompt as a hint, max 63 bytes UTF-8. Alternative: leave `content` empty and force the operator to recognize the npub. The label is purely UX; the npub is the truth. Default = label allowed, but ignored by policy.
+4. **JCS as canonicalization vs. a simpler rule.** JCS is the right answer (RFC standard, used by NIP-01) but not all client languages have a JCS library. Alternative: define a small subset rule ("sort keys lexicographically, no whitespace, JSON-stringify each value"). Default = JCS; revisit if a target client language lacks support.
+5. **Should AF_UNIX accept an `auth` envelope as an *additional* identity claim?** Today this plan says no — AF_UNIX uses `SO_PEERCRED` and ignores `auth`. Alternative: allow a client over AF_UNIX to ALSO send an envelope and have the signer record both `uid:1000` AND `pubkey:<hex>` as identities for the same caller. Adds complexity for a use case nobody has asked for. Default = AF_UNIX ignores `auth`.
+
+---
+
+## Appendix A — Diff against existing plans and docs
+
+- [`plans/deny_by_default_approvals.md`](deny_by_default_approvals.md): unchanged. The deny-by-default rule, prompt outcomes, on-demand role derivation, and `--preapprove` mechanics all continue. Only the *form* of `caller_id` for one transport changes.
+- [`plans/nsigner.md`](nsigner.md): the future-work item "remote TCP mode only with mandatory TLS + authenticated caller key flow" ([`documents/FIPS_DEPLOYMENT.md:177`](../documents/FIPS_DEPLOYMENT.md:177)) is half answered: the auth side is done; TLS at the n_signer layer remains future work.
+- [`documents/SECURITY.md`](../documents/SECURITY.md):
+  - §11 rows for `tcp_remote` and `fips` move from "planned" to "implemented; identity = caller pubkey verified by Schnorr signature."
+  - New subsection in §5 ("the two checks") inserts an auth check ahead of the approval check, applicable only to TCP transport.
+- [`documents/CLIENT_IMPLEMENTATION.md`](../documents/CLIENT_IMPLEMENTATION.md): new chapter "Authenticating over TCP/URL transport" defining the auth envelope, JCS rule, and error codes 2010–2017.
+- [`documents/N_OS_TR_AGENT_CHANGES.md`](../documents/N_OS_TR_AGENT_CHANGES.md): adds a `--preapprove caller=pubkey:<hex>` example for system services that have a stable identity keypair; notes that `--preapprove caller=tcp:...` is deprecated for TCP listeners.
+
+## Appendix B — Why kind 27235 specifically
+
+NIP-42 already defines kind 22242 for "client authentication to relays" with HTTP-Auth-style semantics. Reusing 22242 verbatim would be wrong because the tag schema (`relay`, `challenge`) is relay-specific. Choosing a fresh kind in the parameterized-replaceable range used for HTTP/RPC auth (27235 is used elsewhere for HTTP request auth in some Nostr ecosystems — verify before locking in) lets us define our own tag schema (`nsigner_rpc`, `nsigner_method`, `nsigner_body_hash`) without colliding with relay-auth conventions.
+
+If 27235 turns out to be already claimed by a NIP we do not want to inherit semantics from, the plan can pick a different kind in the same range. The kind is a constant in [`src/auth_envelope.c`](../src/auth_envelope.c) and changing it is a one-line edit in both signer and client.
+
+## Appendix C — Pseudocode: client signing one request
+
+```c
+/* Pseudocode, illustrative only. */
+cJSON *params = build_params_for_method(method);
+
+/* 1. Compute body hash. */
+char *params_jcs = jcs_canonicalize(params);
+unsigned char body_hash[32];
+nostr_sha256((const unsigned char *)params_jcs, strlen(params_jcs), body_hash);
+char body_hash_hex[65];
+nostr_bytes_to_hex(body_hash, 32, body_hash_hex);
+
+/* 2. Build the auth event JSON. */
+cJSON *auth = cJSON_CreateObject();
+cJSON_AddStringToObject(auth, "pubkey", caller_pubkey_hex);
+cJSON_AddNumberToObject(auth, "created_at", (double)time(NULL));
+cJSON_AddNumberToObject(auth, "kind", 27235);
+
+cJSON *tags = cJSON_CreateArray();
+add_tag(tags, "nsigner_rpc",       request_id);
+add_tag(tags, "nsigner_method",    method);
+add_tag(tags, "nsigner_body_hash", body_hash_hex);
+cJSON_AddItemToObject(auth, "tags", tags);
+
+cJSON_AddStringToObject(auth, "content", optional_label_or_empty);
+
+/* 3. Compute event id (sha256 of canonical event header) and sign. */
+unsigned char event_id[32], sig[64];
+compute_nostr_event_id(auth, event_id);            /* helper from nostr_core_lib usage */
+nostr_schnorr_sign(caller_privkey, event_id, sig);
+
+char id_hex[65], sig_hex[129];
+nostr_bytes_to_hex(event_id, 32, id_hex);
+nostr_bytes_to_hex(sig, 64, sig_hex);
+cJSON_AddStringToObject(auth, "id",  id_hex);
+cJSON_AddStringToObject(auth, "sig", sig_hex);
+
+/* 4. Embed in the request and send. */
+cJSON *root = cJSON_CreateObject();
+cJSON_AddStringToObject(root, "id",     request_id);
+cJSON_AddStringToObject(root, "method", method);
+cJSON_AddItemToObject(root,  "params", params);
+cJSON_AddItemToObject(root,  "auth",   auth);
+send_framed(cJSON_PrintUnformatted(root));
+```
+
+The signer side is the same flow in reverse, replacing `nostr_schnorr_sign` with `nostr_verify_event_signature` on the embedded `auth` event.

plans/docker_runtime_image.md

@@ -0,0 +1,277 @@
+# Plan: Runtime Docker image for n_signer with TCP + auth-envelope onboarding
+
+Status: **draft v1 — for review**
+
+This plan documents a path for new users to download and run [`n_signer`](../README.md) inside a Docker container with minimal friction, while preserving the project's existing security posture (zero filesystem footprint at runtime, mlock'd in-memory secrets, deny-by-default approvals, crash-equals-total-wipe). It complements — and does not replace — the native binary distribution.
+
+The companion work breakdown is tracked as todos in this task; this document captures the rationale and architectural decisions behind those todos.
+
+Related plans and references:
+
+- [`plans/caller_token_identity.md`](caller_token_identity.md) — the auth envelope spec that makes TCP a first-class authenticated transport.
+- [`plans/nip46_bunker_mode.md`](nip46_bunker_mode.md) — deferred relay-based transport that would offer a Docker-friendly future alternative.
+- [`Dockerfile.alpine-musl`](../Dockerfile.alpine-musl) — current build-only Dockerfile that this plan extends.
+- [`build_static.sh`](../build_static.sh) — host-side wrapper around the build image.
+- [`increment_and_push.sh`](../increment_and_push.sh) — existing release flow that this plan extends.
+- [`src/server.c`](../src/server.c) — current transport implementation (`unix`, `stdio`, `qrexec`, `tcp:HOST:PORT`).
+- [`src/auth_envelope.c`](../src/auth_envelope.c) — verifier of NIP-01-shaped `kind:27235` auth envelopes.
+
+---
+
+## 1. Why this plan exists
+
+Today a new user has three realistic on-ramps to `n_signer`:
+
+1. Download the static binary from a release and run it natively.
+2. Clone the repo and rebuild via [`build_static.sh`](../build_static.sh), which itself uses Docker as a build environment but produces a host binary.
+3. Hand-roll a `Dockerfile` and `docker run` invocation around the static binary.
+
+None of those produce a one-command `docker pull` + `docker run` experience. [`Dockerfile.alpine-musl`](../Dockerfile.alpine-musl) ends with `FROM scratch` and copies the binary out — it is a build artifact, not a runnable image. This plan closes that gap.
+
+The Docker path also gives users defense-in-depth that the native path cannot offer: PID-namespace isolation prevents same-user processes on the host from `ptrace`'ing the signer, mount-namespace isolation hides the binary, default seccomp shrinks the kernel attack surface, and `--cap-drop ALL` plus `--security-opt no-new-privileges` constrain a hypothetical compromise of the signer itself. None of this defends against host root, kernel exploits, or side channels — that boundary requires a VM-class isolation like the Qubes path described in [`documents/QUBES_OS.md`](../documents/QUBES_OS.md).
+
+---
+
+## 2. Goals
+
+1. **One-command run.** A new user with Docker installed should be able to `docker pull` and `docker run` to get a working interactive `n_signer` TUI, with no source checkout and no manual binary placement.
+2. **Hardened by default.** The recommended invocation in the documentation must include `--read-only`, `--cap-drop ALL`, `--security-opt no-new-privileges`, resource limits, and `127.0.0.1`-only port publishing. Users who copy-paste the docs land on the safer configuration without having to think.
+3. **TCP is the supported transport for the image.** Out of the four current transports, TCP is the only one that crosses the container/host network-namespace boundary cleanly today, and it is the only one with a working caller-authentication story per [`plans/caller_token_identity.md`](caller_token_identity.md). The image's `ENTRYPOINT` reflects this.
+4. **No new transport code in v1.** This plan uses transports that already exist in [`src/server.c`](../src/server.c). Adding a `unix-path` transport variant for bind-mounted UNIX sockets is a separate plan that this one explicitly does not depend on.
+5. **Preserve the runtime invariants.** Zero filesystem footprint at runtime, mlock'd secrets, crash-equals-total-wipe, and human-attended TUI all carry over. The image runs `--read-only`; no state files; SIGTERM from `docker stop` triggers the same wipe path as Ctrl-C in a terminal.
+6. **Verifiable provenance.** Pulled images must be cryptographically verifiable to a release tag, with an SBOM and vulnerability scan attached as release assets so users can inspect what they are running.
+7. **No regression for the native path.** The static-binary distribution and the `build_static.sh` build flow continue to work unchanged. The Docker image is an *additional* on-ramp, not a replacement.
+
+---
+
+## 3. Non-goals
+
+- **No multi-user, long-running daemon mode.** The TUI-attended, foreground-only design from [`README.md`](../README.md) is preserved. The image is run with `-it`, attached to a terminal. Background `docker run -d` is explicitly unsupported and will be documented as such.
+- **No bundled clients.** The image contains only the signer binary. Clients (browser extension, native apps, examples) ship separately.
+- **No persistent volume.** No mnemonic-on-disk, no policy-on-disk. The signer's "no runtime config or state files" rule from [`README.md`](../README.md) applies unchanged inside the container.
+- **No network exposure beyond loopback by default.** The documented invocation publishes ports to `127.0.0.1` only. LAN/WAN exposure is out of scope and would require a separate threat model plus TLS termination, which is its own plan.
+- **No NIP-46 relay transport.** That remains deferred per [`plans/nip46_bunker_mode.md`](nip46_bunker_mode.md).
+- **No host-UNIX-socket bridging.** Bind-mounting a UNIX socket from the container to the host is appealing for UID-based identity but requires a `--listen unix-path:` mode that does not exist today. Tracked as a follow-up note (todo 20), out of scope here.
+- **No image-internal privilege separation.** The signer runs as a single non-root user inside the container; further compartmentalization (separate uid for TUI vs network handling) is not in scope for v1.
+
+---
+
+## 4. Threat model delta vs. the native binary
+
+The Docker image inherits the same in-process threat model as the native binary (mlock'd secrets, no disk artifacts, deny-by-default approvals). It adds:
+
+| Boundary | Native terminal | Docker image (this plan) |
+|---|---|---|
+| Same-UID host process reads signer memory | Vulnerable to `ptrace`, `/proc/<pid>/mem` | Blocked by PID namespace |
+| Compromised signer escalates on host | Has full UID privileges on host | Constrained by `--cap-drop ALL`, `--security-opt no-new-privileges`, default seccomp |
+| Compromised signer writes persistent files | Can write anywhere UID has access | `--read-only` rootfs blocks writes; no volumes mounted |
+| Core dump leaks key material | Possible if `ulimit` or systemd allows | `--read-only` plus no writable paths means no core file path |
+| Host root reads signer memory | Unconstrained | Still unconstrained — `nsenter`, `docker exec`, host `/proc` all work. **Documented as a non-defense.** |
+| Kernel exploit | Full host compromise | Full host compromise — shared kernel. **Documented as a non-defense.** |
+| Network reachability | Bound by socket file perms or abstract namespace | Bound by Docker port publishing; `127.0.0.1` only by docs |
+| TCP caller identity | Auth envelope (per [`plans/caller_token_identity.md`](caller_token_identity.md)) | Same — unchanged inside the container |
+
+The user-facing security message in [`documents/SECURITY.md`](../documents/SECURITY.md) gets a small subsection (todo 12) calling out exactly this — what Docker buys you and what it does not — so users do not over-trust container isolation.
+
+---
+
+## 5. Image architecture
+
+### 5.1 Multi-stage Dockerfile
+
+Extend [`Dockerfile.alpine-musl`](../Dockerfile.alpine-musl) with a third stage that produces a runnable image. The existing two stages — `builder` and the `FROM scratch AS output` extraction stage — are preserved unchanged so [`build_static.sh`](../build_static.sh) keeps working.
+
+```mermaid
+graph LR
+    A[Stage: builder<br/>alpine:3.19 + toolchain] --> B[Stage: output<br/>FROM scratch<br/>used by build_static.sh]
+    A --> C[Stage: runtime<br/>FROM scratch<br/>ENTRYPOINT nsigner]
+    B -.-> D[host binary<br/>build/nsigner_static_*]
+    C -.-> E[OCI image<br/>nsigner:vX.Y.Z]
+
+    style C fill:#9f9
+    style E fill:#9f9
+```
+
+The runtime stage:
+
+- Starts `FROM scratch` (no shell, no libc, no busybox — the binary is fully static MUSL).
+- Copies in the stripped static binary as `/nsigner`.
+- Sets `ENTRYPOINT ["/nsigner"]` and a default `CMD` of `["--listen", "tcp:0.0.0.0:7777"]`. Users can override CMD to pick another transport, but the ENTRYPOINT remains fixed at the binary.
+- Declares OCI image labels (todo 3) — source URL, version, revision (git SHA), licenses, title, description — sourced from the existing `NSIGNER_VERSION` macro that [`increment_and_push.sh`](../increment_and_push.sh) already maintains.
+- Runs as a non-root UID. Because `FROM scratch` has no `/etc/passwd`, this is done with a numeric UID via `USER 65532`. The static binary has no UID-name dependencies.
+- `EXPOSE 7777` for documentation only (does not affect runtime).
+
+### 5.2 Default `--listen` choice
+
+The image defaults to `--listen tcp:0.0.0.0:7777`. Rationale (todo 15):
+
+- It is the only existing transport that crosses the container netns boundary without `--network=host` (which would defeat the isolation we are running Docker for).
+- It is the only transport with a working caller-authentication story today, via the auth envelope verified in [`src/auth_envelope.c`](../src/auth_envelope.c) and required for TCP per [`src/server.c`](../src/server.c) lines around 1313.
+- `0.0.0.0` inside the container is safe **only** when the host publishes to `127.0.0.1`. The documentation makes this binding explicit and warns against `-p 7777:7777` (which publishes to all host interfaces). Todo 16 covers this in detail.
+- Users who want stdio (one-shot) or qrexec (Qubes-specific) override `CMD` themselves; the default targets the dominant Docker-on-laptop case.
+
+### 5.3 Image size and layers
+
+Static MUSL binary, stripped, is roughly single-digit MB. The runtime image will be that plus the OCI metadata — well under 10 MB. `docker pull` is a few seconds on any reasonable connection. This is documented as a property, not just a coincidence, because it directly supports the "easy for new users" goal.
+
+---
+
+## 6. Build, tag, and publish flow
+
+```mermaid
+graph LR
+    Dev[Developer<br/>./increment_and_push.sh -r] --> Bump[Bump version macros]
+    Bump --> Tag[git tag vX.Y.Z]
+    Tag --> Build[Build static binaries<br/>x86_64 + arm64]
+    Build --> Test[Run make test inside builder]
+    Test --> Img[Build runtime image<br/>buildx multiarch]
+    Img --> Sbom[Generate SBOM + vuln scan]
+    Sbom --> Sign[cosign sign image]
+    Sign --> Push[Push image and assets<br/>to registry]
+    Push --> Release[Create Gitea release<br/>with binary, sbom, image digest, verify cmd]
+```
+
+### 6.1 Registry choice
+
+Decision pending (todo 4). Three viable destinations:
+
+1. **The existing Gitea registry at `git.laantungir.net`.** Aligns with the existing release flow that already uses `~/.gitea_token`. Self-hosted, under project control. Downside: less familiar to new users; they may need to log in to pull.
+2. **GitHub Container Registry (GHCR).** Free, public, well-known, integrates with cosign keyless signing using GitHub OIDC. Requires a GitHub mirror.
+3. **Docker Hub.** Most familiar to new users. Rate limits on anonymous pulls. Requires a Docker Hub account and token.
+
+The plan recommends GHCR as primary because keyless cosign signing dramatically simplifies the trust story for new users (`cosign verify ghcr.io/...` with no key management). The Gitea registry is a viable alternative if the project prefers to stay self-hosted; in that case, key-based cosign signing replaces keyless. Either way, the choice is documented up front so users know where to pull from.
+
+### 6.2 Multi-arch
+
+Built via `docker buildx build --platform linux/amd64,linux/arm64`. The existing builder stage already handles both architectures (it picks `libnostr_core_x64.a` vs `libnostr_core_arm64.a` based on `uname -m`). A `Makefile` target (todo 2) wraps this so the developer command is `make docker-image-multiarch`.
+
+### 6.3 Tags
+
+- `vX.Y.Z` — immutable, matches git tag and binary release.
+- `latest` — moves to newest stable release.
+- `vX` and `vX.Y` — moving tags for users who want major/minor pinning.
+
+All tags are signed; `latest` is signed at each release.
+
+### 6.4 Provenance
+
+Every release attaches:
+
+- Image digest (`sha256:...`) in release notes.
+- `cosign verify` command line as a copy-pasteable block.
+- SBOM in SPDX or CycloneDX format (syft) as a release asset and as an OCI attestation attached to the image.
+- Vulnerability scan output (grype or trivy) as a release asset.
+
+This makes "is the image I pulled the one the project published?" a one-command answer. Todos 6 and 7 cover this.
+
+### 6.5 Hooks into the existing release script
+
+[`increment_and_push.sh`](../increment_and_push.sh) currently:
+
+1. Bumps the version macros in `src/main.h` or `src/main.c`.
+2. Tags the commit.
+3. Builds x86_64 and arm64 static binaries.
+4. Verifies `--version` of each binary matches the new tag.
+5. Creates a Gitea release and uploads the binaries and a source tarball.
+
+The image flow plugs in between steps 4 and 5 (todo 5):
+
+5a. Build the runtime image for both architectures via buildx.
+5b. Generate SBOM and vuln scan.
+5c. Sign with cosign.
+5d. Push the image and signatures to the chosen registry.
+5e. Capture the resulting digest for the release notes.
+
+Each of these steps is gated on a credential being present, mirroring the existing `~/.gitea_token` check. A developer without registry credentials still gets a successful binary release; the image steps emit warnings and skip. This keeps the local release flow usable in offline or partial-credential setups.
+
+### 6.6 CI integration
+
+A CI smoke test (todo 13) boots the just-built runtime image with the default `--listen tcp:0.0.0.0:7777`, drives a single `get_public_key` request from a host client over the published port, and asserts a clean shutdown. This catches regressions where the binary builds but cannot actually serve TCP from inside a container — for example, a future code change that defaults to abstract sockets in a way that breaks netns separation.
+
+The existing `make test` suite is also run inside the builder stage (todo 14) before the artifact is extracted, so we have a tested-then-shipped guarantee on the binary that ends up in the image.
+
+---
+
+## 7. New-user runbook (target end-state)
+
+This is the experience the plan is optimizing for. After the work is done, the [`documents/DOCKER.md`](../documents/DOCKER.md) (todo 8) opens with effectively this:
+
+```bash
+# 1. Verify the image you are about to run
+cosign verify ghcr.io/laantungir/nsigner:v0.X.Y \
+  --certificate-identity-regexp 'https://github.com/laantungir/n_signer' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com
+
+# 2. Run with hardened defaults
+docker run -it --rm \
+  --read-only \
+  --cap-drop ALL \
+  --security-opt no-new-privileges \
+  --pids-limit 64 \
+  --memory 128m \
+  -p 127.0.0.1:7777:7777 \
+  ghcr.io/laantungir/nsigner:v0.X.Y
+```
+
+The TUI then comes up exactly as it does for the native binary — mnemonic prompt, role table, status display, approval prompts. From the user's perspective, the only differences are the longer command line and the fact that pressing Ctrl-C now also stops the container.
+
+A second documentation block (todo 9) walks through writing a TCP client that builds a `kind:27235` auth envelope per [`plans/caller_token_identity.md`](caller_token_identity.md), signs it with BIP-340 Schnorr, and gets approved exactly once at the TUI. A worked example client is added to [`examples/`](../examples) (todo 10) so users have a copy-pasteable starting point that they can run on the host against the containerized signer.
+
+---
+
+## 8. Risks and decisions
+
+### 8.1 TCP-only is a real limitation
+
+UID-based identity is preserved on AF_UNIX abstract sockets, which is a strong primitive in the native deployment. In Docker, that primitive is gone — abstract sockets do not cross netns. This plan accepts that and shifts to pubkey-based identity via the auth envelope. The trade-off is documented; users who specifically want UID-based identity stay on the native binary, or wait for the future `unix-path` transport plan (todo 20) that would let them bind-mount a pathname socket and recover `SO_PEERCRED.uid`. UID identity inside the container is also affected by Docker user-namespace remapping, which is another reason this plan does not pretend AF_UNIX inside a container is equivalent to AF_UNIX on the host.
+
+### 8.2 `0.0.0.0` inside the container is unforgiving of misconfiguration
+
+If a user copies the image's default `CMD` but writes `-p 7777:7777` (forgetting the `127.0.0.1:` prefix), they expose the signer to any host on the network. This is documented prominently (todo 16) with the explicit warning. We considered defaulting the CMD to `tcp:127.0.0.1:7777`, but that breaks Docker's port-publishing model — the host-side `127.0.0.1:7777` proxy needs to talk to the container's network interface, which is not loopback. So the safer-looking default is actually broken. The chosen approach (default `0.0.0.0` inside, document loopback publishing on the host) is the only one that works with Docker's networking semantics, but it requires that warning.
+
+### 8.3 TUI under `docker run -it` may have edge cases
+
+The signer's TUI uses raw terminal input for keystroke approvals, ANSI status redraws, and signal-driven shutdown. Most of this works under `docker run -it` but the plan reserves a verification step (todo 19) to confirm:
+
+- `a` / `y` / `n` / `q` / `l` keystrokes deliver the same response as on a native terminal.
+- ANSI redraws do not get garbled by Docker's TTY layer.
+- `docker stop` (which sends SIGTERM, then SIGKILL after grace) triggers the same total-state-wipe path as Ctrl-C, including mnemonic zeroization.
+- `docker kill` (SIGKILL only) leaves no recoverable state — by the existing crash-equals-wipe property, this should already hold, but the plan explicitly tests it.
+
+Any deviation discovered is documented as a caveat in [`documents/DOCKER.md`](../documents/DOCKER.md), not silently worked around.
+
+### 8.4 Host root is not blocked
+
+The plan documents this as a non-defense. Users whose threat model includes "another user on the same host has root" should not assume Docker isolates against that. They should run on a system where they trust root, or move to a Qubes-style VM compartment as documented in [`documents/QUBES_OS.md`](../documents/QUBES_OS.md). This is not a flaw in the plan; it is a property of containers that is easy to misunderstand and therefore worth stating up front.
+
+### 8.5 Image sprawl across registries
+
+If both Gitea and GHCR end up hosting the image, users may pull the wrong one or skip signature verification because "the other registry's image is the same anyway." The decision in §6.1 (one primary registry) is made specifically to avoid this. A secondary mirror is acceptable only if it carries the same digests and the same cosign signatures, and the documentation makes the mirror status explicit.
+
+---
+
+## 9. Out of scope, explicitly
+
+Listed so the plan's scope is clear:
+
+- TLS termination for TCP (a reverse-proxy-in-container pattern).
+- Remote signing (binding TCP to non-loopback). Both require a separate threat model and are deferred.
+- A `--listen unix-path:` transport that would let Docker users bind-mount a pathname socket. Tracked as todo 20 for a follow-up plan.
+- A NIP-46 relay transport. Deferred per [`plans/nip46_bunker_mode.md`](nip46_bunker_mode.md).
+- Reproducible builds in the strict bit-for-bit sense. The static-binary build is already close to deterministic, but full reproducibility (matching digests across rebuilds at a given tag) is its own engineering problem and is not promised here.
+- Distro packages (deb, rpm, Homebrew). The native binary remains a release asset; OS-native packaging is its own track.
+
+---
+
+## 10. Acceptance criteria
+
+The plan is considered delivered when **all** of the following are true:
+
+1. A new user with only Docker installed can pull and run the image with one `docker run` command from [`documents/DOCKER.md`](../documents/DOCKER.md) and see the same TUI they would see from the native binary.
+2. `cosign verify` against the published image passes for the chosen registry, and the verification command is in the release notes for that tag.
+3. SBOM and vulnerability scan output are attached to the release.
+4. Pressing Ctrl-C in the attached terminal, and `docker stop` from another shell, both result in the signer process exiting cleanly with the existing zeroization path having run. No leftover state on the container's writable layer (which is `--read-only` anyway).
+5. A TCP client running on the host, using the example added in todo 10, can complete one `get_public_key` round trip after a single `[a]` approval at the TUI, and a second request from the same client pubkey is served silently.
+6. The CI smoke test (todo 13) is green on every PR that touches `Dockerfile.alpine-musl`, the runtime stage, or `src/server.c`.
+7. [`README.md`](../README.md) links to [`documents/DOCKER.md`](../documents/DOCKER.md) from a "Run in Docker" quickstart section, and [`documents/SECURITY.md`](../documents/SECURITY.md) carries the Docker-specific subsection from todo 12.
+8. The native binary distribution and `make static` flow produce identical artifacts to before this plan landed. No regression.

plans/embedded_nsigner_spawn.md

@@ -0,0 +1,253 @@
+# Plan (future): Host programs that embed and spawn `n_signer`
+
+Status: design only. Do not implement until [`plans/mnemonic_startup_input.md`](mnemonic_startup_input.md) has landed and been used in at least one host program.
+
+This plan describes how a host program (for example `~/lt/nostr_terminal`, future Bitcoin or SSH frontends) can embed the `nsigner` binary into itself and launch it in a new visible terminal window with the mnemonic pre-loaded and pre-approvals declared, without any new on-disk artifact for `nsigner`.
+
+## 1. Why embed at all
+
+Goals motivating this plan:
+
+1. **Single-binary deployment.** A user installs `nostr_terminal` and gets `nsigner` for free; no separate package manager step, no `$PATH` confusion, no version skew.
+2. **Version pinning.** The host always launches the exact `nsigner` it was tested against.
+3. **Zero filesystem footprint preserved.** Spawning `nsigner` does not put a copy of the binary anywhere persistent; it runs out of an anonymous in-kernel memory object.
+4. **Same security boundary.** `nsigner` continues to run as a separate process with its own address space, mlock'd pages, and approval prompt loop. The host does not become the signer; it merely launches it.
+5. **Reusable across host programs.** Any program in the user's `~/lt/*` ecosystem can adopt the same helper.
+
+Non-goals (explicit):
+
+- Running `nsigner` *inside* the host process. That collapses the security boundary and is rejected. See [`documents/SECURITY.md`](../documents/SECURITY.md) "One process. One terminal. One human."
+- Hiding the `nsigner` window. The TUI is the trust anchor; it must be visible and attended.
+- Making `nsigner` a daemon. Same reason.
+
+## 2. Architecture overview
+
+```text
++----------------------------------------------------------------+
+| host program (e.g. nostr_terminal)                             |
+|                                                                |
+|  +-- embedded blob ---------------------------------+          |
+|  |   _binary_nsigner_start ... _binary_nsigner_end  |          |
+|  |   (the full statically-linked nsigner ELF)       |          |
+|  +--------------------------------------------------+          |
+|                                                                |
+|  user types mnemonic into host's TUI                           |
+|     |                                                          |
+|     v                                                          |
+|  nsigner_spawn_embedded(...)                                   |
+|     |                                                          |
+|     | 1. memfd_create(MFD_CLOEXEC)                             |
+|     | 2. write(memfd, blob, blob_len)                          |
+|     | 3. pipe2(stdin_pipe, O_CLOEXEC)                          |
+|     | 4. fork() terminal emulator wrapper                      |
+|     |        child: dup2 stdin_pipe[0] -> 0                    |
+|     |               execvp("kitty","-e","/proc/self/fd/<memfd>"|
+|     |                       --listen unix --name <chosen>      |
+|     |                       --mnemonic-stdin                   |
+|     |                       --preapprove ...)                  |
+|     | 5. parent: write(stdin_pipe[1], mnemonic); close + wipe  |
+|     | 6. return chosen socket name to caller                   |
++----------------------------------------------------------------+
+                                |
+                                v   (new graphical terminal window)
++----------------------------------------------------------------+
+| nsigner (separate process)                                     |
+|   - reads mnemonic from FD 0, closes FD 0                      |
+|   - binds @nsigner_<chosen> abstract unix socket               |
+|   - shows status TUI                                           |
+|   - applies pre-approvals from --preapprove                    |
++----------------------------------------------------------------+
+                                ^
+                                |  (host can now connect)
++----------------------------------------------------------------+
+| host re-uses client/nsigner_client.{c,h} to issue requests     |
++----------------------------------------------------------------+
+```
+
+## 3. Build-time integration
+
+### 3.1 Producing the blob
+
+Add a Makefile rule (in `n_signer`'s Makefile) that exposes the binary as a relocatable object usable by other projects:
+
+```make
+nsigner_blob.o: nsigner
+	$(LD) -r -b binary -o $@ $<
+	# results in symbols:
+	#   _binary_nsigner_start
+	#   _binary_nsigner_end
+	#   _binary_nsigner_size
+```
+
+Alternatives considered:
+
+- `xxd -i nsigner > nsigner_blob.h` — produces a C header with a `unsigned char` array. Works, but adds compile time linear in blob size and blocks ccache usefulness.
+- `objcopy -I binary -O elf64-x86-64 -B i386 nsigner nsigner_blob.o` — same effect as `ld -r -b binary` on most toolchains. Either is fine.
+
+### 3.2 Embedding into the host
+
+The host program adds these lines to its build:
+
+```make
+HOST_OBJS += nsigner_blob.o nsigner_spawn.o
+```
+
+and links them into its final executable. The blob lives in `.data` (read-only on most toolchains) and adds roughly the size of the `nsigner` binary to the host (currently ~1–3 MB for the musl static build).
+
+### 3.3 Symbol declaration
+
+```c
+extern const unsigned char _binary_nsigner_start[];
+extern const unsigned char _binary_nsigner_end[];
+/* size = _binary_nsigner_end - _binary_nsigner_start */
+```
+
+## 4. Runtime spawn helper API
+
+New file pair: `client/nsigner_spawn.h` and `client/nsigner_spawn.c`.
+
+### 4.1 Public API sketch
+
+```c
+typedef struct {
+    /* required */
+    const char *mnemonic;        /* will be written to child stdin pipe and then wiped */
+    size_t      mnemonic_len;
+
+    /* optional */
+    const char *const *preapprove_specs;  /* array of "caller=...,nostr_index=N" strings */
+    size_t             preapprove_count;
+
+    const char *socket_name;     /* if NULL, helper picks a random BIP-39 pair */
+    const char *terminal_hint;   /* "kitty"|"foot"|"alacritty"|"xterm"|... or NULL = autodetect */
+
+    /* outputs */
+    char  *out_socket_name;      /* caller-supplied buffer */
+    size_t out_socket_name_size;
+
+    pid_t *out_terminal_pid;     /* may be NULL */
+} nsigner_spawn_opts_t;
+
+/* Returns 0 on success, negative on error. On success, the embedded nsigner
+ * binary has been written to a memfd, the terminal window has been launched,
+ * the mnemonic has been written into the child's stdin pipe, and the local
+ * `mnemonic` buffer has been zeroized.
+ *
+ * After return, the host can connect to the socket using
+ *   client/nsigner_client.{c,h}
+ * with the chosen socket name in opts->out_socket_name.
+ */
+int nsigner_spawn_embedded(nsigner_spawn_opts_t *opts);
+```
+
+Optional readiness primitive (post-MVP): a `nsigner_spawn_wait_ready()` call that polls the abstract socket until it accepts a connection or until a timeout, so the host doesn't race the child's bind step.
+
+### 4.2 Internal pipeline
+
+1. Validate inputs: non-empty mnemonic, sane buffer sizes, `out_socket_name` non-NULL.
+2. Pick a socket name: random BIP-39 word pair if not provided. Reuses the same name-generation routine that `nsigner` itself uses; consider extracting it into a shared header `src/socket_name.h` already exists ([`src/socket_name.c`](../src/socket_name.c:1)) and exposing the generator publicly.
+3. Create memfd: `memfd_create("nsigner", MFD_CLOEXEC)`. On older kernels (no `memfd_create`), return an error rather than falling back to disk — the whole point is no filesystem footprint. (Linux 3.17+ has memfd; the project's deployment targets all qualify.)
+4. Write the embedded blob to the memfd. `lseek` back to zero is unnecessary because `fexecve`/`execveat` does not care about offset.
+5. Create stdin pipe: `pipe2(stdin_pipe, O_CLOEXEC)`. Mark only the read end as inheritable in the child (clear `FD_CLOEXEC` on the read end after `fork`).
+6. Pick a terminal emulator. Detection order: `$NSIGNER_TERMINAL` env override, then `terminal_hint`, then a built-in priority list:
+
+   | Emulator | Run-this flag | Notes |
+   |---|---|---|
+   | `kitty` | `--detach -- <argv>` | preserves stdin |
+   | `foot` | `-- <argv>` | preserves stdin |
+   | `alacritty` | `-e <argv>` | preserves stdin |
+   | `wezterm` | `start -- <argv>` | preserves stdin |
+   | `xterm` | `-e <argv>` | preserves stdin (legacy reliable) |
+   | `gnome-terminal` | **avoided** | dbus-launches, drops stdin/FDs |
+   | `konsole` | `-e <argv>` | mostly preserves stdin |
+
+   If none found, return an error and let the host print a hint to install one.
+7. Build child argv:
+   - `[0] = chosen_terminal`
+   - `[1..]` = the terminal's "exec" flag(s) and separator
+   - then `[N+0] = "/proc/self/fd/<memfd>"` (path the kernel exposes for the memfd, valid only inside the child's process tree — no on-disk file is created)
+   - then `--listen unix --name <chosen> --mnemonic-stdin`
+   - then each `--preapprove <spec>` pair
+8. `fork()`. In the child:
+   - `dup2(stdin_pipe[0], 0)` (replace stdin with the read end)
+   - `close(stdin_pipe[1])`
+   - clear `FD_CLOEXEC` on the memfd so `/proc/self/fd/<memfd>` resolves after `execvp` runs the terminal — the terminal then runs `nsigner` via the inherited memfd path
+   - `execvp(chosen_terminal, child_argv)`
+9. In the parent:
+   - `close(stdin_pipe[0])`
+   - `write(stdin_pipe[1], mnemonic, mnemonic_len)`
+   - `write(stdin_pipe[1], "\n", 1)`
+   - `close(stdin_pipe[1])`
+   - `secure_memzero` over the host's mnemonic buffer
+   - close the memfd in the parent (the child kernel reference keeps it alive)
+   - copy the chosen socket name into `out_socket_name`
+   - return 0
+
+### 4.3 Failure modes and cleanup
+
+Every failure path must:
+
+- close any FDs already opened (memfd, both pipe ends)
+- zeroize the mnemonic buffer if it was already copied locally
+- not leave a child process behind: if `fork` succeeded but a later step failed, `waitpid` the child after `kill(SIGTERM)`
+
+A short error-string accessor (`const char *nsigner_spawn_strerror(int)`) keeps callers from needing to know the internal codes.
+
+## 5. Security review (to perform before implementation)
+
+These items are flagged now so the implementation phase doesn't drift:
+
+1. **Confirm memfd contents are not exposed to other processes.** `/proc/self/fd/<memfd>` is per-process; another process cannot dereference another's `/proc/self/fd/N`. Document that fact in the code comments and in [`documents/SECURITY.md`](../documents/SECURITY.md).
+2. **Confirm `MFD_CLOEXEC` actually closes on the *outer* exec.** We need the memfd open across `fork`+`execvp(terminal)` but want it gone from the terminal emulator's children that aren't `nsigner`. Tested behavior: clear `FD_CLOEXEC` only on this one FD before `execvp` so the terminal inherits it; the terminal itself doesn't close arbitrary FDs in its child by default but a few do. Document the matrix.
+3. **Sealing.** Optionally `fcntl(memfd, F_ADD_SEALS, F_SEAL_WRITE | F_SEAL_SHRINK | F_SEAL_GROW)` before exec, so even a compromised child cannot rewrite the binary it is about to execute.
+4. **Pre-approval defaults.** The helper must NOT silently inject a default `--preapprove` for the host's uid. The host must declare every approval explicitly. This keeps the `documents/SECURITY.md` "deny by default" guarantee intact.
+5. **Mnemonic in pipe buffer.** The kernel pipe buffer (4 KiB) holds the mnemonic for the moment between parent's `write` and child's `read`. This is in-kernel anonymous memory, comparable to a `mlock`'d page in lifetime, and is freed when both ends close. Acceptable.
+6. **Mnemonic in environment of the host.** The helper does not put the mnemonic in `envp`. It only goes through the pipe.
+7. **Host trust elevation.** When the host calls this helper, the host program joins the trust chain (it already had the mnemonic). Document that in [`documents/SECURITY.md`](../documents/SECURITY.md) §2.3 trust-anchors table.
+8. **Terminal emulator trust.** The chosen terminal emulator is now part of the trust chain (it sees stdin and could capture it). Document; recommend `kitty`/`foot`/`alacritty`/`xterm` and warn against modifying via plugins/config that record stdin.
+
+## 6. Documentation deliverables
+
+- `documents/SPAWN.md`: how host programs embed `nsigner_blob.o` and use `nsigner_spawn.{c,h}`.
+- Update [`documents/SECURITY.md`](../documents/SECURITY.md) §2.3 with the host-program and terminal-emulator trust-chain rows.
+- Update [`README.md`](../README.md) §3.1 with a one-paragraph "Running embedded inside a host program" note pointing here.
+- New worked example `examples/spawn_and_sign.c`: takes a mnemonic from its own argv (for the example only — clearly labeled "EXAMPLE: argv mnemonic, not for production"), spawns `nsigner` via the helper, then issues `get_public_key` over the resulting socket and prints the result. This demonstrates the full pattern in ~80 lines.
+
+## 7. Testing strategy
+
+Tests are inherently more involved because they require spawning a real terminal emulator. Recommended approach:
+
+1. **Unit tests for the helper** (`tests/test_spawn_unit.c`):
+   - argv builder produces the expected list given a fixture options struct.
+   - terminal autodetect returns the correct emulator given a fake `$PATH`.
+   - the memfd write produces a payload whose first 4 bytes are `\x7fELF` (sanity).
+2. **Integration test under a headless terminal** (`tests/test_spawn_integration.c`):
+   - use `xvfb-run` plus `xterm -e` (or `foot --headless`-ish modes if available) so CI can spawn a window without a display server.
+   - the test passes a known mnemonic, waits for the abstract socket to appear, calls `get_public_key`, asserts the returned pubkey matches the BIP-39 vector for that mnemonic.
+   - this test is gated on a build flag because not every CI environment has a usable headless emulator; `make test-spawn` rather than the default `make test`.
+3. **Manual smoke checklist** in `documents/SPAWN.md` covering the four supported emulators.
+
+## 8. Open questions to resolve before implementation
+
+- Should the helper live in `client/` (next to `nsigner_client.{c,h}`) or in a new top-level `embed/` directory? Recommendation: `client/` keeps related host-side code together.
+- Should the embedded blob be compressed (e.g. zstd-decompress on the fly into the memfd)? Probably not for the first version — extra dependency, marginal size benefit on already-small statically-linked `nsigner`.
+- How does this interact with code signing on platforms that enforce it (Windows, macOS, signed Linux distros)? Linux generally allows `fexecve` of memfd content; macOS would require a different path. The plan is Linux-only for now; document that.
+- Should `nsigner` itself learn a `--print-socket-name-on-startup` flag (one line to a designated FD) so the spawn helper doesn't have to choose the name? Useful future addition; keep it as a follow-up after the memfd path proves out.
+
+## 9. Acceptance criteria (when the time comes to implement)
+
+- [ ] `make nsigner_blob.o` produces a relocatable object usable by host projects.
+- [ ] `client/nsigner_spawn.{c,h}` compiles cleanly and links into a host program with no extra dependencies.
+- [ ] `examples/spawn_and_sign.c` runs end-to-end and prints a valid pubkey.
+- [ ] No file is created on disk during a successful spawn (verified by `lsof` snapshot or `inotifywait` on `/tmp`, `/run/user/$UID`, `$HOME`).
+- [ ] Host's mnemonic buffer is wiped on the path to `execvp`.
+- [ ] Pre-approvals declared by the host appear in the spawned `nsigner`'s policy table without prompting.
+- [ ] Documentation updates landed in `documents/SPAWN.md`, [`documents/SECURITY.md`](../documents/SECURITY.md), and [`README.md`](../README.md).
+- [ ] Tests in `tests/test_spawn_unit.c` pass on plain CI; `tests/test_spawn_integration.c` passes under `xvfb-run` on the spawn-CI lane.
+
+## 10. Relationship to other plans
+
+- Builds on [`plans/mnemonic_startup_input.md`](mnemonic_startup_input.md) — the embedded helper consumes `--mnemonic-stdin`.
+- Compatible with [`plans/deny_by_default_approvals.md`](deny_by_default_approvals.md) — every host-issued approval still goes through `--preapprove`.
+- Compatible with [`plans/caller_token_identity.md`](caller_token_identity.md) — host identity is conveyed via `unix_peer` over the abstract socket like any other client.
+- Companion to [`plans/auth_envelope_other_transports.md`](auth_envelope_other_transports.md): a host that spawns `nsigner` may also wish to forward authenticated requests on its behalf; out of scope here.

plans/mnemonic_startup_input.md

@@ -0,0 +1,195 @@
+# Plan: Non-interactive mnemonic input at startup (`--mnemonic-stdin`, `--mnemonic-fd`)
+
+Status: ready to implement.
+Related: [`documents/SECURITY.md`](../documents/SECURITY.md), [`src/main.c`](../src/main.c:1006), [`src/mnemonic.c`](../src/mnemonic.c:1).
+Companion plan (future work): [`plans/embedded_nsigner_spawn.md`](embedded_nsigner_spawn.md).
+
+## 1. Goal
+
+Allow `n_signer` to receive its mnemonic from a parent process at startup, without the human re-typing it, while preserving the project's existing security posture:
+
+- nothing on the filesystem
+- nothing in argv (no `--mnemonic <phrase>` flag)
+- nothing in environment (no `NSIGNER_MNEMONIC` env var) for production use
+- the mnemonic source is wiped from process memory immediately after a successful load
+
+Two new CLI flags are added:
+
+- `--mnemonic-stdin` — read one line from stdin during the unlock phase, treat that line as the mnemonic, then continue to the normal status display. Stdin is closed (or replaced with `/dev/null`) before the running phase begins so the listener loop and TUI hotkeys keep working.
+- `--mnemonic-fd N` — read one line from file descriptor `N`, then close it. Intended to be wired by parent processes to a `pipe2(O_CLOEXEC)` write end or a `memfd_create(2)` region. **No filesystem path is involved** — `N` is an inherited FD number, equivalent to stdin in lifecycle but separable so it can coexist with `--listen stdio`.
+
+The existing interactive TUI prompt remains the default when neither flag is given.
+
+## 2. Why no `--mnemonic <phrase>` argv flag
+
+Listed only to make the rejection explicit and discoverable in `git log`:
+
+- visible to every same-uid process via `/proc/<pid>/cmdline`
+- captured by `ps auxww`
+- captured by shell history (`bash`/`zsh` `HISTFILE`)
+- captured by audit subsystems (`auditd`, sysmon-like agents)
+- captured by container/VM platform telemetry that records launch commands
+
+Stdin and inherited FDs do not appear in any of those surfaces. They are the right primitive.
+
+Likewise no `NSIGNER_MNEMONIC` environment variable, because envp is exposed via `/proc/<pid>/environ` to same-uid readers. Any future env-based override should be opt-in for testing only and named `NSIGNER_TEST_*` like the existing test hooks.
+
+## 3. CLI surface changes
+
+### 3.1 New flags (in [`src/main.c`](../src/main.c:1187))
+
+| Flag | Argument | Behavior |
+|---|---|---|
+| `--mnemonic-stdin` | none | read mnemonic from FD 0, then close FD 0 and reopen as `/dev/null` |
+| `--mnemonic-fd <N>` | int | read mnemonic from FD `N`, then close FD `N` |
+
+Both flags are mutually exclusive with each other.
+
+### 3.2 Compatibility with `--listen` modes
+
+| Listen mode | `--mnemonic-stdin` | `--mnemonic-fd` |
+|---|---|---|
+| `unix` (default) | OK | OK |
+| `tcp:HOST:PORT` | OK | OK |
+| `stdio` | **rejected** (stdin is the request transport) | OK (FD must not be 0/1) |
+| `qrexec` | **rejected** (stdio is the request transport) | OK (FD must not be 0/1) |
+
+If both `--mnemonic-stdin` and `--listen stdio`/`qrexec` are passed, `n_signer` exits with a clear error before doing anything else.
+
+`--mnemonic-fd` rejects `N == 0` if `--listen stdio`/`qrexec` is also passed, and rejects `N == 1` always (stdout is reserved for response framing in stdio/qrexec modes and for the TUI in unix/tcp modes).
+
+### 3.3 Updated `print_usage()`
+
+Two new lines added under the existing options section:
+
+```
+  --mnemonic-stdin    Read mnemonic from stdin (one line). Default unlock prompt is skipped.
+  --mnemonic-fd N     Read mnemonic from inherited FD N (anonymous, no filesystem). Same-line semantics.
+```
+
+### 3.4 `--help` discoverability
+
+The current `print_usage()` block in [`src/main.c`](../src/main.c:615) already lists the other flags in tabular form; the two new lines slot in next to `--auth`. No structural change.
+
+## 4. Behavioral spec
+
+### 4.1 `prompt_load_mnemonic` becomes `load_mnemonic`
+
+The existing function [`prompt_load_mnemonic()`](../src/main.c:1006) is renamed/refactored to `load_mnemonic(mnemonic_state_t*, mnemonic_source_t)` where:
+
+```c
+typedef enum {
+    MNEMONIC_SRC_TUI_PROMPT = 0,   /* current default behavior */
+    MNEMONIC_SRC_STDIN,            /* --mnemonic-stdin */
+    MNEMONIC_SRC_FD,               /* --mnemonic-fd N */
+} mnemonic_source_kind_t;
+
+typedef struct {
+    mnemonic_source_kind_t kind;
+    int fd;                        /* used for SRC_STDIN (=0) and SRC_FD */
+} mnemonic_source_t;
+```
+
+For `SRC_STDIN` and `SRC_FD`:
+
+1. Read up to `MNEMONIC_MAX_LEN` bytes from the FD using a small bounded read loop (`read(2)`), stopping at the first `\n` or EOF.
+2. Trim a single trailing `\n` and any single trailing `\r` (handle Windows-style line endings just in case).
+3. Reject input containing any embedded `\0` (defensive; mnemonic is text).
+4. Reject input that ends without seeing EOF or `\n` after `MNEMONIC_MAX_LEN` bytes (caller is misbehaving).
+5. Pass the buffer to [`mnemonic_load()`](../src/mnemonic.c:1) which already validates word count.
+6. Zeroize the local read buffer with `secure_memzero` regardless of success/failure.
+7. On success, close the source FD. For `SRC_STDIN`, also `dup2()` `/dev/null` onto FD 0 so subsequent `read()`s on FD 0 don't accidentally consume bytes meant for nothing.
+8. On failure (read error, validation error), exit non-zero. There is **no retry loop** in non-interactive mode — the parent should fix its input and re-spawn; silently retrying could mask a serious bug like leaked mnemonic-passing logic.
+
+For `SRC_TUI_PROMPT`: unchanged, current behavior preserved verbatim, including the existing 10-attempt retry loop.
+
+### 4.2 Lock/unlock keystroke (`l` hotkey)
+
+Currently the `l` hotkey calls [`prompt_load_mnemonic()`](../src/main.c:1527) again interactively. After this change:
+
+- If the original startup used the TUI prompt: `l` re-runs the TUI prompt (unchanged).
+- If the original startup used `--mnemonic-stdin` or `--mnemonic-fd`: the source FD has already been closed and zeroized, so re-locking would have no source to re-read from. Two options:
+  - **Option A (chosen):** the `l` hotkey falls back to the TUI prompt on re-unlock, regardless of how the original unlock happened. The user is at the terminal, so the TUI prompt is always available.
+  - Option B: disable `l` entirely if non-interactive source was used. Rejected — too restrictive.
+
+Implementation: track the original source kind in a `static` in main.c; when the user presses `l` after non-interactive startup, log a one-line notice ("re-unlock via terminal prompt") and call the TUI variant.
+
+### 4.3 Trim/normalize rules
+
+The mnemonic line is treated as ASCII text. Allowed transformations before validation:
+
+- strip a single trailing `\r\n` or `\n`
+- strip leading and trailing ASCII whitespace (space, tab)
+- collapse internal runs of whitespace? **No** — `mnemonic_load()` already tokenizes on whitespace; passing the trimmed string through unchanged is simpler and matches typed-mnemonic behavior.
+
+### 4.4 Error messages
+
+All errors go to stderr (not the TUI), prefixed `nsigner:`, and exit with status 1:
+
+- `nsigner: --mnemonic-stdin and --mnemonic-fd are mutually exclusive`
+- `nsigner: --mnemonic-stdin requires --listen unix or --listen tcp:...`
+- `nsigner: --mnemonic-fd N: invalid FD value`
+- `nsigner: --mnemonic-fd N: read failed: <strerror>`
+- `nsigner: mnemonic input exceeded maximum length`
+- `nsigner: mnemonic validation failed`
+
+The actual mnemonic content is **never** printed in any error message. The generic "validation failed" message is intentional.
+
+## 5. Security review checklist
+
+Items the implementer should verify before merging:
+
+1. The stack buffer used for the read is wiped with `secure_memzero` on every exit path, including early-error returns.
+2. If an `mlock`-backed temporary buffer is used instead of a stack buffer, it must be `secure_buf_alloc`'d and `secure_buf_free`'d.
+3. The source FD is `close(2)`'d after read, before `mnemonic_load` returns control to `main()`. Close happens even on failure paths.
+4. For `--mnemonic-stdin`, FD 0 is replaced with `/dev/null` (`open("/dev/null", O_RDONLY)` then `dup2`) so later code paths cannot read leftover bytes.
+5. The new flags are documented in [`README.md`](../README.md) §3.1 (Startup phase) with an explicit note that they are intended for parent-process spawning and that the parent is responsible for FD hygiene.
+6. The new flags are documented in [`documents/SECURITY.md`](../documents/SECURITY.md) under §2 ("trust anchors") — the parent process now joins the trust chain when these flags are used.
+7. No new path is added that prints the mnemonic to logs, the activity buffer, or any debug output.
+8. `man`-style banner / help output never echoes the mnemonic.
+
+## 6. Testing plan
+
+New tests:
+
+- `tests/test_mnemonic_input.c` (new file) covering:
+  1. `--mnemonic-stdin` happy path: spawn `nsigner` with a pipe, write a valid 12-word mnemonic + `\n`, expect successful unlock.
+  2. `--mnemonic-stdin` invalid mnemonic: write garbage, expect non-zero exit.
+  3. `--mnemonic-stdin` no newline before EOF: write valid mnemonic without `\n`, close pipe, expect success.
+  4. `--mnemonic-stdin` line too long: write 1024 bytes, expect non-zero exit with the length error.
+  5. `--mnemonic-fd 3` happy path: parent opens an `O_CLOEXEC=0` pipe, dups its write end as FD 3 in the child via `posix_spawn_file_actions_*`, writes mnemonic, expects success.
+  6. Mutually-exclusive flag combinations: `--mnemonic-stdin --mnemonic-fd 3`, `--mnemonic-stdin --listen stdio`, `--mnemonic-fd 0 --listen stdio` — all expected to exit 1 with the matching error string.
+  7. Lock-then-reunlock after `--mnemonic-stdin` startup: verify the TUI prompt path still works (using `NSIGNER_TEST_HOTKEYS` and `NSIGNER_TEST_NONINTERACTIVE_PROMPT` test hooks).
+
+Existing tests must continue to pass:
+
+- [`tests/test_mnemonic.c`](../tests/test_mnemonic.c) (mnemonic library unit tests — unchanged surface)
+- [`tests/test_integration.c`](../tests/test_integration.c) (default TUI-prompt path)
+- [`tests/test.sh`](../tests/test.sh) wrapper.
+
+Add a row to `Makefile` `test` target for the new test binary.
+
+## 7. Documentation updates
+
+- [`README.md`](../README.md) §3.1: add a paragraph at the end noting the two new flags and pointing to this plan.
+- [`documents/SECURITY.md`](../documents/SECURITY.md) §2.3: add a row to the trust-anchors table for "the parent process when `--mnemonic-stdin`/`--mnemonic-fd` is used".
+- [`documents/CLIENT_IMPLEMENTATION.md`](../documents/CLIENT_IMPLEMENTATION.md): no changes (client wire protocol unaffected).
+- New section in [`README.md`](../README.md) under "Operating modes" pointing readers to the future spawning plan once that lands.
+
+## 8. Out of scope (handled by companion plan)
+
+- Embedding the `nsigner` binary into a host program via `objcopy` blob + `memfd_create` + `fexecve`. See [`plans/embedded_nsigner_spawn.md`](embedded_nsigner_spawn.md).
+- Reusable C client helper that picks a terminal emulator and wires the pipe. Same companion plan.
+- `examples/spawn_and_sign.c`. Same companion plan.
+
+## 9. Acceptance criteria
+
+- [ ] `nsigner --mnemonic-stdin` reads one line, validates, and proceeds to status display without prompting.
+- [ ] `nsigner --mnemonic-fd 3` (with FD 3 inherited from a parent test harness) does the same.
+- [ ] Invalid mnemonics exit non-zero with the generic validation message; mnemonic content is never printed.
+- [ ] Mutually exclusive flag combinations are rejected at argument-parse time.
+- [ ] `--listen stdio` and `--mnemonic-stdin` are mutually exclusive.
+- [ ] After non-interactive unlock, pressing `l` falls back to the TUI prompt for re-unlock and the running phase otherwise behaves identically.
+- [ ] The mnemonic source FD is closed and the source buffer is zeroized on every path.
+- [ ] All existing tests still pass; new tests in `tests/test_mnemonic_input.c` pass.
+- [ ] [`README.md`](../README.md) and [`documents/SECURITY.md`](../documents/SECURITY.md) are updated.

plans/nip46_bunker_mode.md

@@ -0,0 +1,98 @@
+# Plan: Deferred NIP-46 bunker transport mode
+
+Status: **deferred (design only, not in current implementation scope)**
+
+This document records a future transport mode where `n_signer` can operate as a NIP-46-compatible bunker over relays, while keeping the current local/TCP framed JSON-RPC path intact.
+
+Current implementation priority remains [`plans/caller_token_identity.md`](caller_token_identity.md): required per-request caller authentication for TCP/URL using signed auth envelopes and existing `n_signer` request flow.
+
+---
+
+## 1. Why this is deferred
+
+NIP-46 adds more than caller authentication:
+
+- Relay session lifecycle and routing
+- NIP-44 encrypted request/response payloads
+- `connect` ceremony and secret verification
+- Signer service identity (`remote-signer-pubkey`) management
+- Compatibility behavior for `nostrconnect://` and `bunker://`
+
+That is a separate subsystem from the immediate bugfix (stable, authenticated caller identity over TCP reconnects). Combining both now would increase risk and delay rollout.
+
+---
+
+## 2. Future objective
+
+Add an optional mode (example: `--listen nip46`) that accepts NIP-46 `kind:24133` requests and returns NIP-46 `kind:24133` responses as defined in [`resources/nips/46.md`](../resources/nips/46.md).
+
+This mode should:
+
+1. Authenticate client requests using NIP-46 client keypairs and encrypted content.
+2. Map NIP-46 caller identity to the same deny-by-default approval model already used by current transports.
+3. Reuse existing dispatcher/enforcement/policy machinery after transport decoding.
+
+---
+
+## 3. Compatibility stance (future)
+
+- Keep current framed JSON-RPC transports (`AF_UNIX`, `qrexec`, `tcp`) as first-class for local deployments.
+- Add NIP-46 as **additional** transport, not replacement.
+- Shared internal core: once a request is decoded into `(caller_id, method, params, selector)`, the same policy and enforcement pipeline runs.
+
+---
+
+## 4. Planned phases
+
+### Phase A — Transport shell
+
+- Add `nip46` listen mode and relay I/O loop.
+- Parse and validate incoming `kind:24133` envelope.
+- Decrypt NIP-44 payload and extract JSON-RPC-like `method` + `params`.
+
+### Phase B — Identity + approval binding
+
+- Derive caller identity from NIP-46 `client-pubkey`.
+- Represent as `caller_id = pubkey:<hex>` to align with the current TCP auth direction in [`plans/caller_token_identity.md`](caller_token_identity.md).
+- Route to existing policy checks and prompt behavior.
+
+### Phase C — Response path
+
+- Convert dispatcher results into NIP-46 response payloads.
+- Encrypt via NIP-44 and emit `kind:24133` response event.
+- Preserve request `id` correlation and error mapping.
+
+### Phase D — Connect / secret / perms polish
+
+- Implement full `connect` handshake semantics from [`resources/nips/46.md`](../resources/nips/46.md:100).
+- Validate optional secret behavior.
+- Support requested permissions metadata and signer-side policy translation.
+
+### Phase E — Operational hardening
+
+- Relay switching behavior (`switch_relays`), lifecycle recovery.
+- Rate limits and replay protections specific to relay transport.
+- Audit/event logs for NIP-46 connections and requests.
+
+---
+
+## 5. Open design questions (for later)
+
+1. Should NIP-46 mode require a dedicated signer identity key, or may it reuse the user signing identity?
+2. How should `connect` permissions map to `n_signer` role/selector approvals?
+3. Should NIP-46 callers and TCP-auth callers share the same `pubkey:<hex>` approval namespace by default?
+4. Do we support both relay-initiated and direct-client initiation flows from day one?
+5. What minimum relay trust assumptions are required in `documents/SECURITY.md`?
+
+---
+
+## 6. Out of scope for current code work
+
+The current implementation task does **not** include:
+
+- Adding relay networking
+- NIP-44 tunnel encryption for requests
+- NIP-46 `connect` handshake
+- `nostrconnect://` URI flow
+
+Those remain deferred to this plan.

plans/tui_continuous_integration.md

@@ -0,0 +1,101 @@
+# tui_continuous integration plan for n_signer
+
+## Goal
+
+Adopt the `tui_continuous` style from `/home/user/lt/aesthetics` with minimal-risk restructuring:
+
+- keep caller-owned poll loop and line-input model
+- avoid ncurses/event-loop inversion
+- preserve non-interactive behavior and test compatibility
+
+## Scope
+
+### 1) Vendor and wire library
+
+- Vendor `tui_continuous.c/.h` into this repository under a stable path (planned: `resources/tui_continuous/`).
+- Add include path and source wiring to:
+  - `Makefile` dev build
+  - targets that link `src/main.c` (notably integration path)
+  - static build flow (`build_static.sh`, Alpine musl path)
+
+### 2) Main-screen TUI adapter in `src/main.c`
+
+- Introduce a small adapter layer that owns:
+  - persistent `TuiFrame` (`app_name=nsigner`, `app_version=NSIGNER_VERSION`, breadcrumb)
+  - hotkey menu definitions matching existing behavior (`q/x`, `l`, `r`, `A`)
+  - status text composition (`locked/unlocked`, words, socket, derived, auto-approve)
+
+### 3) Replace legacy `render_status()` with `tui_continuous`
+
+- Use `tui_render_screen()` for top framing/menu/status strip.
+- Render roles with `tui_render_table()` using columns:
+  - role name
+  - purpose
+  - curve
+  - selector
+- Render activity log (latest first) via `tui_print()`.
+- Keep prompt anchoring stable with `tui_anchor_prompt()`.
+
+### 4) Resize behavior
+
+- Install SIGWINCH handler with `tui_install_resize_handler()` before unix interactive loop.
+- On each poll tick, if `tui_resize_pending()` is set, repaint current view.
+
+### 5) Approval flow refactor (`src/server.c` + `src/main.c`)
+
+- Add server approval callback API in `server.c`:
+  - callback typedef
+  - registration function (`server_set_approval_cb(...)`)
+  - compact request payload struct (caller/method/role/purpose/derivation + optional peer display)
+- Keep default callback behavior equivalent to existing stdio prompt output for non-TUI and tests.
+- In `main.c` unix interactive mode, register a TUI-aware callback that:
+  - paints an approval content screen
+  - shows `[y]/[n]/[e]/[a]` options
+  - reads line input (fgets-compatible behavior)
+  - returns policy decision enums
+  - repaints main status screen after decision
+
+### 6) Mnemonic prompt styling
+
+- Keep `fgets` input path intact for paste reliability.
+- Re-style startup and lock/reunlock prompts using `tui_render_content_screen()` + `tui_print()`.
+
+### 7) Output safety boundaries
+
+- Keep machine-readable output untouched (client JSON-RPC responses remain raw).
+- Restrict style updates for non-interactive surfaces to human-facing usage/banner text only.
+
+### 8) Validation
+
+- Run/build validation for:
+  - normal dev build
+  - static build flow
+  - existing prompt-related test paths (`NSIGNER_TEST_FORCE_PROMPT`, `NSIGNER_TEST_NONINTERACTIVE_PROMPT`)
+- Manual visual checks:
+  - narrow/normal/wide terminal widths
+  - live resize behavior
+  - approval prompt arriving during idle and proper redraw afterwards
+
+### 9) Documentation updates
+
+- Update `README.md` and security docs where relevant to mention:
+  - adopted TUI style source (`aesthetics/TUI.md`)
+  - vendored `tui_continuous` component/version
+
+## Execution order
+
+1. Vendor library and wire build
+2. Implement main screen adapter + rendering
+3. Add resize repaint
+4. Refactor approval callback plumbing
+5. Add TUI approval view in main
+6. Re-style mnemonic prompts
+7. Validate tests/builds + manual UX checks
+8. Update docs
+
+## Non-goals
+
+- No ncurses integration
+- No event loop ownership changes
+- No changes to transport semantics (`unix`, `stdio`, `qrexec`, `tcp`)
+- No machine-readable output format changes

run.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BUILD_SCRIPT="$SCRIPT_DIR/build_static.sh"
+BUILD_DIR="$SCRIPT_DIR/build"
+
+HOST_UNAME="$(uname -m)"
+case "$HOST_UNAME" in
+    x86_64)
+        OUTPUT_NAME="nsigner_static_x86_64"
+        ;;
+    aarch64|arm64)
+        OUTPUT_NAME="nsigner_static_arm64"
+        ;;
+    armv7l|armv7)
+        OUTPUT_NAME="nsigner_static_armv7"
+        ;;
+    *)
+        echo "ERROR: Unsupported host architecture '$HOST_UNAME'"
+        exit 1
+        ;;
+esac
+
+"$BUILD_SCRIPT"
+
+BINARY_PATH="$BUILD_DIR/$OUTPUT_NAME"
+if [[ ! -x "$BINARY_PATH" ]]; then
+    echo "ERROR: Compiled binary not found or not executable: $BINARY_PATH"
+    exit 1
+fi
+
+exec "$BINARY_PATH" "$@"

src/auth_envelope.c

@@ -0,0 +1,409 @@
+#define _GNU_SOURCE
+
+#include "auth_envelope.h"
+
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include <cJSON.h>
+#include <nostr_core/nip001.h>
+#include <nostr_core/utils.h>
+
+static int set_error(int *out_code,
+                     const char **out_message,
+                     int code,
+                     const char *message) {
+    if (out_code != NULL) {
+        *out_code = code;
+    }
+    if (out_message != NULL) {
+        *out_message = message;
+    }
+    return -1;
+}
+
+void auth_nonce_cache_init(auth_nonce_cache_t *cache) {
+    if (cache == NULL) {
+        return;
+    }
+    memset(cache, 0, sizeof(*cache));
+}
+
+static int auth_nonce_cache_contains(const auth_nonce_cache_t *cache, const uint8_t id[32]) {
+    int i;
+
+    if (cache == NULL || id == NULL) {
+        return 0;
+    }
+
+    for (i = 0; i < cache->count; ++i) {
+        if (memcmp(cache->ids[i], id, 32) == 0) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+static void auth_nonce_cache_insert(auth_nonce_cache_t *cache, const uint8_t id[32]) {
+    if (cache == NULL || id == NULL) {
+        return;
+    }
+
+    if (cache->count < AUTH_NONCE_CACHE_SIZE) {
+        memcpy(cache->ids[cache->count], id, 32);
+        cache->count++;
+        return;
+    }
+
+    memcpy(cache->ids[cache->next], id, 32);
+    cache->next = (cache->next + 1) % AUTH_NONCE_CACHE_SIZE;
+}
+
+static int json_item_to_compact_string(const cJSON *item, char *out, size_t out_sz) {
+    char *printed;
+
+    if (out == NULL || out_sz == 0 || item == NULL) {
+        return -1;
+    }
+
+    if (cJSON_IsString(item) && item->valuestring != NULL) {
+        strncpy(out, item->valuestring, out_sz - 1);
+        out[out_sz - 1] = '\0';
+        return 0;
+    }
+
+    printed = cJSON_PrintUnformatted((cJSON *)item);
+    if (printed == NULL) {
+        return -1;
+    }
+
+    strncpy(out, printed, out_sz - 1);
+    out[out_sz - 1] = '\0';
+    free(printed);
+    return 0;
+}
+
+static int compute_hash_hex_for_json_item(const cJSON *item, char *out_hex, size_t out_hex_sz) {
+    unsigned char hash[32];
+    char *compact = NULL;
+
+    if (out_hex == NULL || out_hex_sz < 65) {
+        return -1;
+    }
+
+    if (item == NULL) {
+        compact = strdup("null");
+    } else {
+        compact = cJSON_PrintUnformatted((cJSON *)item);
+    }
+
+    if (compact == NULL) {
+        return -1;
+    }
+
+    if (nostr_sha256((const unsigned char *)compact, strlen(compact), hash) != 0) {
+        free(compact);
+        return -1;
+    }
+
+    nostr_bytes_to_hex(hash, sizeof(hash), out_hex);
+    out_hex[64] = '\0';
+    free(compact);
+    return 0;
+}
+
+static int compute_params_hash_hex(cJSON *root, char *out_hex, size_t out_hex_sz) {
+    cJSON *params = cJSON_GetObjectItemCaseSensitive(root, "params");
+    return compute_hash_hex_for_json_item(params, out_hex, out_hex_sz);
+}
+
+static cJSON *find_tag_value(cJSON *tags, const char *name) {
+    int i;
+
+    if (!cJSON_IsArray(tags) || name == NULL) {
+        return NULL;
+    }
+
+    for (i = 0; i < cJSON_GetArraySize(tags); ++i) {
+        cJSON *tag = cJSON_GetArrayItem(tags, i);
+        cJSON *tag_name;
+        cJSON *tag_value;
+
+        if (!cJSON_IsArray(tag) || cJSON_GetArraySize(tag) < 2) {
+            continue;
+        }
+
+        tag_name = cJSON_GetArrayItem(tag, 0);
+        tag_value = cJSON_GetArrayItem(tag, 1);
+        if (!cJSON_IsString(tag_name) || tag_name->valuestring == NULL) {
+            continue;
+        }
+        if (strcmp(tag_name->valuestring, name) != 0) {
+            continue;
+        }
+
+        return tag_value;
+    }
+
+    return NULL;
+}
+
+static cJSON *build_tag_pair(const char *name, const char *value) {
+    cJSON *pair;
+
+    if (name == NULL || value == NULL) {
+        return NULL;
+    }
+
+    pair = cJSON_CreateArray();
+    if (pair == NULL) {
+        return NULL;
+    }
+
+    cJSON_AddItemToArray(pair, cJSON_CreateString(name));
+    cJSON_AddItemToArray(pair, cJSON_CreateString(value));
+    return pair;
+}
+
+int auth_envelope_build_for_request(const char *request_id,
+                                    const char *method,
+                                    const cJSON *params,
+                                    const unsigned char privkey[32],
+                                    const char *label,
+                                    time_t created_at,
+                                    cJSON **out_auth) {
+    cJSON *tags = NULL;
+    cJSON *auth = NULL;
+    char body_hash_hex[65];
+
+    if (out_auth == NULL || request_id == NULL || method == NULL ||
+        privkey == NULL || request_id[0] == '\0' || method[0] == '\0') {
+        return -1;
+    }
+
+    *out_auth = NULL;
+
+    if (compute_hash_hex_for_json_item(params, body_hash_hex, sizeof(body_hash_hex)) != 0) {
+        return -1;
+    }
+
+    tags = cJSON_CreateArray();
+    if (tags == NULL) {
+        return -1;
+    }
+
+    cJSON_AddItemToArray(tags, build_tag_pair("nsigner_rpc", request_id));
+    cJSON_AddItemToArray(tags, build_tag_pair("nsigner_method", method));
+    cJSON_AddItemToArray(tags, build_tag_pair("nsigner_body_hash", body_hash_hex));
+
+    if (created_at <= 0) {
+        created_at = time(NULL);
+    }
+
+    auth = nostr_create_and_sign_event(AUTH_EVENT_KIND,
+                                       (label != NULL) ? label : "",
+                                       tags,
+                                       privkey,
+                                       created_at);
+
+    if (auth == NULL) {
+        cJSON_Delete(tags);
+        return -1;
+    }
+
+    *out_auth = auth;
+    return 0;
+}
+
+int auth_envelope_verify_request(const char *request_json,
+                                 auth_nonce_cache_t *cache,
+                                 int skew_seconds,
+                                 char *out_pubkey_hex,
+                                 size_t out_pubkey_hex_sz,
+                                 char *out_label,
+                                 size_t out_label_sz,
+                                 int *out_error_code,
+                                 const char **out_error_message) {
+    cJSON *root = NULL;
+    cJSON *auth = NULL;
+    cJSON *method_item;
+    cJSON *id_item;
+    cJSON *kind_item;
+    cJSON *created_item;
+    cJSON *pubkey_item;
+    cJSON *content_item;
+    cJSON *id_hex_item;
+    cJSON *tags_item;
+    cJSON *tag_rpc;
+    cJSON *tag_method;
+    cJSON *tag_body_hash;
+    char request_id[128];
+    char body_hash_hex[65];
+    uint8_t nonce_bytes[32];
+    time_t now;
+    long long created;
+
+    if (out_error_code != NULL) {
+        *out_error_code = 0;
+    }
+    if (out_error_message != NULL) {
+        *out_error_message = NULL;
+    }
+
+    if (out_pubkey_hex == NULL || out_pubkey_hex_sz < 65 ||
+        out_label == NULL || out_label_sz == 0 ||
+        request_json == NULL || cache == NULL) {
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MALFORMED,
+                         "auth_envelope_malformed");
+    }
+
+    out_pubkey_hex[0] = '\0';
+    out_label[0] = '\0';
+
+    root = cJSON_Parse(request_json);
+    if (root == NULL) {
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MALFORMED,
+                         "auth_envelope_malformed");
+    }
+
+    method_item = cJSON_GetObjectItemCaseSensitive(root, "method");
+    id_item = cJSON_GetObjectItemCaseSensitive(root, "id");
+    if (!cJSON_IsString(method_item) || method_item->valuestring == NULL ||
+        json_item_to_compact_string(id_item, request_id, sizeof(request_id)) != 0) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MALFORMED,
+                         "auth_envelope_malformed");
+    }
+
+    auth = cJSON_GetObjectItemCaseSensitive(root, "auth");
+    if (!cJSON_IsObject(auth)) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_REQUIRED,
+                         "auth_envelope_required");
+    }
+
+    if (nostr_validate_event_structure(auth) != 0) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MALFORMED,
+                         "auth_envelope_malformed");
+    }
+
+    if (nostr_verify_event_signature(auth) != 0) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_SIGNATURE_INVALID,
+                         "auth_signature_invalid");
+    }
+
+    kind_item = cJSON_GetObjectItemCaseSensitive(auth, "kind");
+    if (!cJSON_IsNumber(kind_item) || kind_item->valueint != AUTH_EVENT_KIND) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_KIND_INVALID,
+                         "auth_kind_invalid");
+    }
+
+    tags_item = cJSON_GetObjectItemCaseSensitive(auth, "tags");
+    tag_rpc = find_tag_value(tags_item, "nsigner_rpc");
+    tag_method = find_tag_value(tags_item, "nsigner_method");
+    tag_body_hash = find_tag_value(tags_item, "nsigner_body_hash");
+    if (!cJSON_IsString(tag_rpc) || tag_rpc->valuestring == NULL ||
+        !cJSON_IsString(tag_method) || tag_method->valuestring == NULL ||
+        !cJSON_IsString(tag_body_hash) || tag_body_hash->valuestring == NULL) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MALFORMED,
+                         "auth_envelope_malformed");
+    }
+
+    if (strcmp(tag_rpc->valuestring, request_id) != 0 ||
+        strcmp(tag_method->valuestring, method_item->valuestring) != 0) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MISMATCH,
+                         "auth_envelope_mismatch");
+    }
+
+    if (compute_params_hash_hex(root, body_hash_hex, sizeof(body_hash_hex)) != 0 ||
+        strcasecmp(tag_body_hash->valuestring, body_hash_hex) != 0) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_BODY_MISMATCH,
+                         "auth_body_mismatch");
+    }
+
+    created_item = cJSON_GetObjectItemCaseSensitive(auth, "created_at");
+    if (!cJSON_IsNumber(created_item)) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MALFORMED,
+                         "auth_envelope_malformed");
+    }
+
+    if (skew_seconds <= 0) {
+        skew_seconds = AUTH_DEFAULT_SKEW_SECONDS;
+    }
+
+    now = time(NULL);
+    created = (long long)created_item->valuedouble;
+    if (llabs((long long)now - created) > (long long)skew_seconds) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_STALE,
+                         "auth_envelope_stale");
+    }
+
+    id_hex_item = cJSON_GetObjectItemCaseSensitive(auth, "id");
+    if (!cJSON_IsString(id_hex_item) || id_hex_item->valuestring == NULL ||
+        strlen(id_hex_item->valuestring) != 64 ||
+        nostr_hex_to_bytes(id_hex_item->valuestring, nonce_bytes, sizeof(nonce_bytes)) != 0) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MALFORMED,
+                         "auth_envelope_malformed");
+    }
+
+    if (auth_nonce_cache_contains(cache, nonce_bytes)) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_REPLAY_DETECTED,
+                         "auth_replay_detected");
+    }
+    auth_nonce_cache_insert(cache, nonce_bytes);
+
+    pubkey_item = cJSON_GetObjectItemCaseSensitive(auth, "pubkey");
+    if (!cJSON_IsString(pubkey_item) || pubkey_item->valuestring == NULL ||
+        strlen(pubkey_item->valuestring) != 64) {
+        cJSON_Delete(root);
+        return set_error(out_error_code, out_error_message,
+                         AUTH_ERR_ENVELOPE_MALFORMED,
+                         "auth_envelope_malformed");
+    }
+
+    strncpy(out_pubkey_hex, pubkey_item->valuestring, out_pubkey_hex_sz - 1);
+    out_pubkey_hex[out_pubkey_hex_sz - 1] = '\0';
+
+    content_item = cJSON_GetObjectItemCaseSensitive(auth, "content");
+    if (cJSON_IsString(content_item) && content_item->valuestring != NULL) {
+        size_t i;
+        for (i = 0; content_item->valuestring[i] != '\0' && i + 1 < out_label_sz; ++i) {
+            unsigned char ch = (unsigned char)content_item->valuestring[i];
+            out_label[i] = (char)((isprint(ch) && ch != '\n' && ch != '\r' && ch != '\t') ? ch : ' ');
+        }
+        out_label[i] = '\0';
+    } else {
+        out_label[0] = '\0';
+    }
+
+    cJSON_Delete(root);
+    return 0;
+}

src/auth_envelope.h

@@ -0,0 +1,49 @@
+#ifndef NSIGNER_AUTH_ENVELOPE_H
+#define NSIGNER_AUTH_ENVELOPE_H
+
+#include <stddef.h>
+#include <stdint.h>
+#include <time.h>
+
+#include <cJSON.h>
+
+#define AUTH_NONCE_CACHE_SIZE 1024
+#define AUTH_DEFAULT_SKEW_SECONDS 30
+#define AUTH_EVENT_KIND 27235
+
+#define AUTH_ERR_ENVELOPE_MALFORMED 2010
+#define AUTH_ERR_BODY_MISMATCH 2011
+#define AUTH_ERR_SIGNATURE_INVALID 2012
+#define AUTH_ERR_KIND_INVALID 2013
+#define AUTH_ERR_ENVELOPE_REQUIRED 2014
+#define AUTH_ERR_ENVELOPE_MISMATCH 2015
+#define AUTH_ERR_ENVELOPE_STALE 2016
+#define AUTH_ERR_REPLAY_DETECTED 2017
+
+typedef struct {
+    uint8_t ids[AUTH_NONCE_CACHE_SIZE][32];
+    int count;
+    int next;
+} auth_nonce_cache_t;
+
+void auth_nonce_cache_init(auth_nonce_cache_t *cache);
+
+int auth_envelope_verify_request(const char *request_json,
+                                 auth_nonce_cache_t *cache,
+                                 int skew_seconds,
+                                 char *out_pubkey_hex,
+                                 size_t out_pubkey_hex_sz,
+                                 char *out_label,
+                                 size_t out_label_sz,
+                                 int *out_error_code,
+                                 const char **out_error_message);
+
+int auth_envelope_build_for_request(const char *request_id,
+                                    const char *method,
+                                    const cJSON *params,
+                                    const unsigned char privkey[32],
+                                    const char *label,
+                                    time_t created_at,
+                                    cJSON **out_auth);
+
+#endif

src/dispatcher.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -396,7 +396,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

src/enforcement.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -384,7 +384,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

src/key_store.c

@@ -231,7 +231,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -389,7 +389,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

src/main.c

@@ -234,7 +234,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -271,6 +271,8 @@ typedef struct {
 
 /* Policy check result */
 #define POLICY_ALLOW               0
+#define POLICY_ALLOW_SESSION_VERB  3
+#define POLICY_ALLOW_SESSION_ALL   4
 #define POLICY_DENY               -1
 #define POLICY_PROMPT             -2   /* would need user confirmation */
 #define POLICY_NO_MATCH           -3   /* no policy entry matched (fail-closed = deny) */
@@ -395,13 +397,17 @@ char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request)
 #define NSIGNER_LISTEN_QREXEC 2
 #define NSIGNER_LISTEN_TCP    3
 
+#define NSIGNER_AUTH_OFF      0
+#define NSIGNER_AUTH_OPTIONAL 1
+#define NSIGNER_AUTH_REQUIRED 2
+
 /* Caller identity */
 typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
     int kind;
-    char caller_id[64];     /* "uid:<n>" or "qubes:<vm>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];     /* "uid:<n>" or "qubes:<vm>" */
     char source_qube[64];
 } caller_identity_t;
 
@@ -416,12 +422,16 @@ typedef struct {
     dispatcher_ctx_t *dispatcher;
     policy_table_t *policy;
     int socket_name_explicit;
+    int auth_mode;
+    int auth_skew_seconds;
 } server_ctx_t;
 
 /* Initialize server context. socket_name is the abstract namespace name (e.g. "nsigner").
  * socket_name_explicit should be non-zero when provided via --socket-name override. */
 void server_init(server_ctx_t *ctx, const char *socket_name, int socket_name_explicit,
                  int listen_mode,
+                 int auth_mode,
+                 int auth_skew_seconds,
                  dispatcher_ctx_t *dispatcher, policy_table_t *policy);
 
 /* Start listening. Returns 0 on success, -1 on error. */
@@ -447,6 +457,19 @@ void server_set_prompt_always_allow(int enabled);
 /* Configure non-interactive prompt fallback: -1 disabled, POLICY_ALLOW, or POLICY_DENY */
 void server_set_noninteractive_prompt_default(int decision);
 
+typedef struct {
+    const caller_identity_t *caller;
+    const char *method;
+    const char *role_name;
+    const char *purpose;
+    int pending_derivation;
+    const char *fips_peer_npub;
+    const char *fips_peer_name;
+} server_approval_request_t;
+
+typedef int (*server_approval_cb)(const server_approval_request_t *req, void *user_data);
+void server_set_approval_cb(server_approval_cb cb, void *user_data);
+
 /* from socket_name.h */
 
 
@@ -468,8 +491,8 @@ int socket_name_random(char *out, size_t out_len);
 /* Version information (auto-updated by build/version tooling) */
 #define NSIGNER_VERSION_MAJOR 0
 #define NSIGNER_VERSION_MINOR 0
-#define NSIGNER_VERSION_PATCH 19
-#define NSIGNER_VERSION "v0.0.19"
+#define NSIGNER_VERSION_PATCH 27
+#define NSIGNER_VERSION "v0.0.27"
 
 
 /* NSIGNER_HEADERLESS_DECLS_END */
@@ -477,6 +500,8 @@ int socket_name_random(char *out, size_t out_len);
 int transport_send_framed(int fd, const char *payload);
 int transport_recv_framed(int fd, char **out_payload, size_t max_size);
 
+#include "auth_envelope.h"
+#include "tui_continuous.h"
 #include <nostr_core/nostr_common.h>
 
 #include <arpa/inet.h>
@@ -484,9 +509,12 @@ int transport_recv_framed(int fd, char **out_payload, size_t max_size);
 #include <errno.h>
 #include <poll.h>
 #include <signal.h>
+#include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <fcntl.h>
+#include <limits.h>
 #include <strings.h>
 #include <sys/socket.h>
 #include <sys/types.h>
@@ -497,6 +525,7 @@ int transport_recv_framed(int fd, char **out_payload, size_t max_size);
 
 #define NSIGNER_DEFAULT_SOCKET_NAME "nsigner"
 #define ACTIVITY_LOG_CAP 16
+#define CONNECTION_INFO_CAP 8
 
 typedef struct {
     char lines[ACTIVITY_LOG_CAP][256];
@@ -507,6 +536,66 @@ static volatile sig_atomic_t g_running = 1;
 static activity_log_t g_activity_log;
 static int g_auto_approve = 0;
 
+typedef enum {
+    MNEMONIC_SOURCE_TUI = 0,
+    MNEMONIC_SOURCE_STDIN,
+    MNEMONIC_SOURCE_FD
+} mnemonic_source_kind_t;
+
+typedef struct {
+    mnemonic_source_kind_t kind;
+    int fd;
+} mnemonic_source_t;
+
+static mnemonic_source_kind_t g_startup_mnemonic_source_kind = MNEMONIC_SOURCE_TUI;
+static char g_connection_info[CONNECTION_INFO_CAP][192];
+static int g_connection_info_count = 0;
+
+static const TuiMenuItem g_main_menu_items[] = {
+    {"^_q^:/x quit", 'q'},
+    {"^_l^: lock/reunlock", 'l'},
+    {"^_r^: refresh", 'r'},
+    {"^_A^: toggle auto-approve", 'a'}
+};
+
+typedef struct {
+    const role_table_t *role_table;
+} role_table_view_data_t;
+
+typedef struct {
+    const role_table_t *role_table;
+    const mnemonic_state_t *mnemonic;
+    int *derived_count;
+    const char *socket_name;
+} main_tui_context_t;
+
+static void render_status(const role_table_t *role_table,
+                          const mnemonic_state_t *mnemonic,
+                          int derived_count,
+                          const char *socket_name);
+
+static void connection_info_clear(void) {
+    g_connection_info_count = 0;
+    memset(g_connection_info, 0, sizeof(g_connection_info));
+}
+
+static void connection_info_add(const char *fmt, ...) {
+    va_list ap;
+
+    if (fmt == NULL || g_connection_info_count >= CONNECTION_INFO_CAP) {
+        return;
+    }
+
+    va_start(ap, fmt);
+    (void)vsnprintf(g_connection_info[g_connection_info_count],
+                    sizeof(g_connection_info[g_connection_info_count]),
+                    fmt,
+                    ap);
+    va_end(ap);
+
+    g_connection_info_count++;
+}
+
 static void handle_signal(int sig) {
     (void)sig;
     g_running = 0;
@@ -533,6 +622,126 @@ static int read_line_stdin(char *buf, size_t buf_sz) {
 }
 
 
+static int read_cmd_output_local(const char *cmd, char **out_buf) {
+    FILE *fp;
+    char chunk[512];
+    char *buf = NULL;
+    size_t used = 0;
+    size_t cap = 0;
+
+    if (cmd == NULL || out_buf == NULL) {
+        return -1;
+    }
+
+    *out_buf = NULL;
+    fp = popen(cmd, "r");
+    if (fp == NULL) {
+        return -1;
+    }
+
+    while (fgets(chunk, sizeof(chunk), fp) != NULL) {
+        size_t n = strlen(chunk);
+        if (used + n + 1 > cap) {
+            size_t new_cap = (cap == 0) ? 2048 : cap * 2;
+            while (new_cap < used + n + 1) {
+                new_cap *= 2;
+            }
+            {
+                char *tmp = (char *)realloc(buf, new_cap);
+                if (tmp == NULL) {
+                    free(buf);
+                    (void)pclose(fp);
+                    return -1;
+                }
+                buf = tmp;
+                cap = new_cap;
+            }
+        }
+        memcpy(buf + used, chunk, n);
+        used += n;
+    }
+
+    (void)pclose(fp);
+
+    if (buf == NULL) {
+        return -1;
+    }
+
+    buf[used] = '\0';
+    *out_buf = buf;
+    return 0;
+}
+
+static int lookup_local_fips_identity(char *out_ipv6,
+                                      size_t out_ipv6_sz,
+                                      char *out_npub,
+                                      size_t out_npub_sz) {
+    char *json = NULL;
+    cJSON *root = NULL;
+    cJSON *ipv6_item;
+    cJSON *npub_item;
+
+    if (out_ipv6 == NULL || out_ipv6_sz == 0 || out_npub == NULL || out_npub_sz == 0) {
+        return -1;
+    }
+
+    out_ipv6[0] = '\0';
+    out_npub[0] = '\0';
+
+    if (read_cmd_output_local("fipsctl show status 2>/dev/null", &json) != 0) {
+        return -1;
+    }
+
+    root = cJSON_Parse(json);
+    free(json);
+    if (root == NULL) {
+        return -1;
+    }
+
+    ipv6_item = cJSON_GetObjectItemCaseSensitive(root, "ipv6_addr");
+    npub_item = cJSON_GetObjectItemCaseSensitive(root, "npub");
+
+    if (cJSON_IsString(ipv6_item) && ipv6_item->valuestring != NULL) {
+        strncpy(out_ipv6, ipv6_item->valuestring, out_ipv6_sz - 1);
+        out_ipv6[out_ipv6_sz - 1] = '\0';
+    }
+
+    if (cJSON_IsString(npub_item) && npub_item->valuestring != NULL) {
+        strncpy(out_npub, npub_item->valuestring, out_npub_sz - 1);
+        out_npub[out_npub_sz - 1] = '\0';
+    }
+
+    cJSON_Delete(root);
+    return (out_ipv6[0] != '\0' && out_npub[0] != '\0') ? 0 : -1;
+}
+
+static int extract_listen_port(const char *listen_target, char *out_port, size_t out_port_sz) {
+    const char *port;
+    size_t i;
+
+    if (listen_target == NULL || out_port == NULL || out_port_sz == 0) {
+        return -1;
+    }
+
+    out_port[0] = '\0';
+
+    port = strrchr(listen_target, ':');
+    if (port == NULL || *(port + 1) == '\0') {
+        return -1;
+    }
+    port++;
+
+    for (i = 0; port[i] != '\0'; ++i) {
+        if (!isdigit((unsigned char)port[i])) {
+            return -1;
+        }
+    }
+
+    strncpy(out_port, port, out_port_sz - 1);
+    out_port[out_port_sz - 1] = '\0';
+    return 0;
+}
+
 static int connect_abstract_socket(const char *name) {
     int fd;
     struct sockaddr_un addr;
@@ -563,19 +772,27 @@ static int connect_abstract_socket(const char *name) {
 }
 
 static void print_usage(const char *program_name) {
-    printf("nsigner - single-binary signer program\n");
-    printf("Usage:\n");
-    printf("  %s [--socket-name|--name|-n <name>] [--listen <unix|stdio|qrexec|tcp:HOST:PORT>]\n", program_name);
-    printf("                                           [--preapprove <SPEC>]...\n");
-    printf("                                           Run signer server (unix mode has TUI)\n");
-    printf("  %s [--socket-name|--name|-n <name>] client '<json>' Send JSON-RPC request\n", program_name);
-    printf("  %s [--socket-name|--name|-n <name>] client -        Read JSON-RPC request from stdin\n", program_name);
-    printf("  %s list                                    List running nsigner abstract sockets\n", program_name);
-    printf("  %s --help\n", program_name);
-    printf("  %s --version\n", program_name);
-    printf("\nOptions:\n");
-    printf("  --preapprove SPEC   Pre-approve a caller for a role (repeatable)\n");
-    printf("                      SPEC: caller=<id>,role=<name> or caller=<id>,nostr_index=<n>\n");
+    tui_print("nsigner - single-binary signer program");
+    tui_print("Usage:");
+    tui_print("  %s [--socket-name|--name|-n <name>] [--listen|-l <unix|stdio|qrexec|tcp:HOST:PORT>]", program_name);
+    tui_print("                                           [--preapprove|-p <SPEC>]... [--auth|-a <off|optional|required>]");
+    tui_print("                                           [--mnemonic-stdin|--mnemonic-fd <N>] [--allow-all|-A]");
+    tui_print("                                           Run signer server (unix mode has TUI)");
+    tui_print("  %s [--socket-name|--name|-n <name>] client '<json>' Send JSON-RPC request", program_name);
+    tui_print("  %s [--socket-name|--name|-n <name>] client -        Read JSON-RPC request from stdin", program_name);
+    tui_print("  %s list                                    List running nsigner abstract sockets", program_name);
+    tui_print("  %s --help", program_name);
+    tui_print("  %s --version", program_name);
+    tui_print("");
+    tui_print("Options:");
+    tui_print("  --listen, -l MODE   Listener transport: unix|stdio|qrexec|tcp:HOST:PORT");
+    tui_print("  --preapprove, -p SPEC");
+    tui_print("                      Pre-approve a caller for a role (repeatable)");
+    tui_print("                      SPEC: caller=<id>,role=<name> or caller=<id>,nostr_index=<n>");
+    tui_print("  --auth, -a MODE     Auth envelope policy per listener: off|optional|required");
+    tui_print("  --mnemonic-stdin    Read mnemonic from stdin (one line) at startup");
+    tui_print("  --mnemonic-fd N     Read mnemonic from inherited fd N (one line) at startup");
+    tui_print("  --allow-all, -A     Allow all policy prompts for this server session");
 }
 
 static int extract_nsigner_socket_from_proc_line(const char *line,
@@ -789,50 +1006,161 @@ static void tcp_activity_stdout_cb(const char *message, void *user_data) {
     fflush(stdout);
 }
 
+static void role_table_get_cell(int row, int col, char *out, size_t out_size, void *user_data) {
+    const role_table_view_data_t *view = (const role_table_view_data_t *)user_data;
+    const role_entry_t *r;
+
+    if (out == NULL || out_size == 0 || view == NULL || view->role_table == NULL ||
+        row < 0 || row >= view->role_table->count) {
+        return;
+    }
+
+    r = &view->role_table->entries[row];
+    switch (col) {
+        case 0:
+            (void)snprintf(out, out_size, "%s", r->name);
+            break;
+        case 1:
+            (void)snprintf(out, out_size, "%s", role_purpose_to_str(r->purpose));
+            break;
+        case 2:
+            (void)snprintf(out, out_size, "%s", role_curve_to_str(r->curve));
+            break;
+        case 3:
+            (void)snprintf(out, out_size, "%s", (r->selector_type == SELECTOR_NOSTR_INDEX) ? "nostr_index" : "role_path");
+            break;
+        default:
+            out[0] = '\0';
+            break;
+    }
+}
+
 static void render_status(const role_table_t *role_table,
                           const mnemonic_state_t *mnemonic,
                           int derived_count,
                           const char *socket_name) {
-    int i;
-    int shown;
+    TuiFrame frame = { "n_signer", NSIGNER_VERSION, "> Main Menu" };
+    TuiMenu menu = { g_main_menu_items, (int)(sizeof(g_main_menu_items) / sizeof(g_main_menu_items[0])) };
+    TuiSize size = tui_terminal_size();
+    int left_col = tui_menu_left_col(&frame, size.width);
+    char status_buf[256];
 
-    printf("\n=== n_signer %s ===\n", NSIGNER_VERSION);
-    printf("session: %s (%d words)\n",
+    tui_clear_continuous(size.height);
+    tui_render_top_frame(&frame, size.width);
+
+    tui_print("^*Connections^:");
+    if (g_connection_info_count == 0) {
+        tui_print("(none)");
+    } else {
+        for (int i = 0; i < g_connection_info_count; ++i) {
+            tui_print("%s", g_connection_info[i]);
+        }
+    }
+
+    tui_print("");
+    tui_render_menu(&menu, left_col);
+    tui_print("");
+
+    (void)snprintf(status_buf,
+                   sizeof(status_buf),
+                   "session=%s (%d words) signer=%s derived=%d auto-approve=%s",
                    mnemonic_is_loaded(mnemonic) ? "unlocked" : "locked",
-           (mnemonic != NULL) ? mnemonic->word_count : 0);
-    printf("signer : %s\n", (socket_name != NULL) ? socket_name : "(none)");
-    printf("derived: %d\n", derived_count);
-
-    printf("\nRoles\n-----\n");
-    if (role_table == NULL || role_table->count == 0) {
-        printf("(none)\n");
-    } else {
-        for (i = 0; i < role_table->count; ++i) {
-            const role_entry_t *r = &role_table->entries[i];
-            printf("%s  purpose=%s curve=%s selector=%s\n",
-                   r->name,
-                   role_purpose_to_str(r->purpose),
-                   role_curve_to_str(r->curve),
-                   (r->selector_type == SELECTOR_NOSTR_INDEX) ? "nostr_index" : "role_path");
-        }
-    }
-
-    printf("\nActivity (latest first)\n-----------------------\n");
-    if (g_activity_log.count == 0) {
-        printf("(none)\n");
-    } else {
-        shown = 0;
-        for (i = g_activity_log.count - 1; i >= 0 && shown < ACTIVITY_LOG_CAP; --i, ++shown) {
-            printf("%s\n", g_activity_log.lines[i % ACTIVITY_LOG_CAP]);
-        }
-    }
-
-    printf("\nHotkeys\n-------\n");
-    printf("q/x quit  l lock/reunlock  r refresh  A toggle auto-approve(prompt): %s\n",
+                   (mnemonic != NULL) ? mnemonic->word_count : 0,
+                   (socket_name != NULL) ? socket_name : "(none)",
+                   derived_count,
                    g_auto_approve ? "ON" : "OFF");
+    tui_print("%s", status_buf);
+
+    tui_print("^*Roles^:");
+    if (role_table == NULL || role_table->count == 0) {
+        tui_print("(none)");
+    } else {
+        static const TuiColumn columns[] = {
+            {"Role", 20, 0},
+            {"Purpose", 12, 0},
+            {"Curve", 12, 0},
+            {"Selector", 12, 0}
+        };
+        role_table_view_data_t view;
+        TuiTable table;
+
+        view.role_table = role_table;
+        table.columns = columns;
+        table.column_count = (int)(sizeof(columns) / sizeof(columns[0]));
+        table.row_count = role_table->count;
+        table.user_data = &view;
+        table.get_cell = role_table_get_cell;
+        table.is_default = NULL;
+        table.prefix_len = NULL;
+        tui_render_table(&table);
+    }
+
+    tui_print("");
+    tui_print("^*Activity (latest first)^:");
+    if (g_activity_log.count == 0) {
+        tui_print("(none)");
+    } else {
+        int i;
+        int shown = 0;
+        for (i = g_activity_log.count - 1; i >= 0 && shown < ACTIVITY_LOG_CAP; --i, ++shown) {
+            tui_print("%s", g_activity_log.lines[i % ACTIVITY_LOG_CAP]);
+        }
+    }
+
+    tui_anchor_prompt(0, left_col);
     fflush(stdout);
 }
 
+static int tui_approval_cb(const server_approval_request_t *req, void *user_data) {
+    main_tui_context_t *ctx = (main_tui_context_t *)user_data;
+    TuiFrame frame = { "n_signer", NSIGNER_VERSION, "> Approval" };
+    char choice[32];
+    int decision = POLICY_DENY;
+
+    tui_render_content_screen(&frame, "Approval required");
+    tui_print("caller: %s", (req != NULL && req->caller != NULL) ? req->caller->caller_id : "unknown");
+    if (req != NULL && req->fips_peer_npub != NULL) {
+        if (req->fips_peer_name != NULL && req->fips_peer_name[0] != '\0') {
+            tui_print("fips peer: %s (%s)", req->fips_peer_npub, req->fips_peer_name);
+        } else {
+            tui_print("fips peer: %s", req->fips_peer_npub);
+        }
+    }
+    tui_print("method: %s", (req != NULL && req->method != NULL) ? req->method : "unknown");
+    tui_print("role: %s", (req != NULL && req->role_name != NULL) ? req->role_name : "unknown");
+    tui_print("purpose: %s", (req != NULL && req->purpose != NULL) ? req->purpose : "unknown");
+    if (req != NULL && req->pending_derivation) {
+        tui_print("** NEW IDENTITY — will be derived if approved **");
+    }
+    tui_print("");
+    tui_print("^_y^: allow once");
+    tui_print("^_n^: deny");
+    tui_print("^_e^: allow this caller+role+verb for session");
+    tui_print("^_a^: allow this caller+role for session (all verbs)");
+    printf("> ");
+    fflush(stdout);
+
+    if (read_line_stdin(choice, sizeof(choice)) == 0) {
+        char ch = (char)tolower((unsigned char)choice[0]);
+        if (ch == 'a') {
+            decision = POLICY_ALLOW_SESSION_ALL;
+        } else if (ch == 'e') {
+            decision = POLICY_ALLOW_SESSION_VERB;
+        } else if (ch == 'y') {
+            decision = POLICY_ALLOW;
+        }
+    }
+
+    if (ctx != NULL) {
+        render_status(ctx->role_table,
+                      ctx->mnemonic,
+                      (ctx->derived_count != NULL) ? *ctx->derived_count : 0,
+                      ctx->socket_name);
+    }
+
+    return decision;
+}
+
 static int setup_default_role(role_table_t *role_table) {
     role_entry_t role;
 
@@ -853,7 +1181,7 @@ static int setup_default_role(role_table_t *role_table) {
     return role_table_add(role_table, &role);
 }
 
-static int prompt_load_mnemonic(mnemonic_state_t *mnemonic) {
+static int prompt_load_mnemonic_tui(mnemonic_state_t *mnemonic) {
     char phrase[MNEMONIC_MAX_LEN];
     char phrase_copy[MNEMONIC_MAX_LEN];
     char mode[MNEMONIC_MAX_LEN];
@@ -865,8 +1193,14 @@ static int prompt_load_mnemonic(mnemonic_state_t *mnemonic) {
     }
 
     while (invalid_attempts < max_invalid_attempts) {
-        printf("Mnemonic source: [E]nter existing or [G]enerate new (default E; you can also paste mnemonic here): ");
+        {
+            TuiFrame frame = { "n_signer", NSIGNER_VERSION, "> Unlock" };
+            tui_render_content_screen(&frame, "Load mnemonic");
+            tui_print("Mnemonic source: [E]nter existing or [G]enerate new");
+            tui_print("Default is E; you can also paste full mnemonic here.");
+            printf("> ");
             fflush(stdout);
+        }
         if (read_line_stdin(mode, sizeof(mode)) != 0) {
             fprintf(stderr, "Failed to read mnemonic source choice\n");
             return -1;
@@ -904,13 +1238,24 @@ static int prompt_load_mnemonic(mnemonic_state_t *mnemonic) {
             strncpy(phrase_copy, phrase, sizeof(phrase_copy) - 1);
             phrase_copy[sizeof(phrase_copy) - 1] = '\0';
 
-            printf("\nGenerated mnemonic (WRITE THIS DOWN - it will not be shown again):\n");
+            tui_print("");
+            tui_print("Generated mnemonic (WRITE THIS DOWN - it will not be shown again):");
             word = strtok_r(phrase_copy, " ", &ctx);
             while (word != NULL) {
                 printf("%2d. %s\n", idx, word);
                 idx++;
                 word = strtok_r(NULL, " ", &ctx);
             }
+            tui_print("");
+            tui_print("Press Enter after writing down your mnemonic to continue.");
+            printf("> ");
+            fflush(stdout);
+            if (read_line_stdin(mode, sizeof(mode)) != 0) {
+                fprintf(stderr, "Failed to read continue input\n");
+                memset(phrase, 0, sizeof(phrase));
+                memset(phrase_copy, 0, sizeof(phrase_copy));
+                return -1;
+            }
 
             if (mnemonic_load(mnemonic, phrase) != 0) {
                 memset(phrase, 0, sizeof(phrase));
@@ -925,8 +1270,13 @@ static int prompt_load_mnemonic(mnemonic_state_t *mnemonic) {
             return 0;
         }
 
-        printf("Enter mnemonic (12/15/18/21/24 words): ");
+        {
+            TuiFrame frame = { "n_signer", NSIGNER_VERSION, "> Unlock" };
+            tui_render_content_screen(&frame, "Enter mnemonic");
+            tui_print("Enter mnemonic (12/15/18/21/24 words):");
+            printf("> ");
             fflush(stdout);
+        }
 
         if (read_line_stdin(phrase, sizeof(phrase)) != 0) {
             fprintf(stderr, "Failed to read mnemonic\n");
@@ -957,6 +1307,118 @@ static int prompt_load_mnemonic(mnemonic_state_t *mnemonic) {
     return -1;
 }
 
+static int read_mnemonic_from_fd(int fd, char *out, size_t out_sz) {
+    size_t len = 0;
+    int saw_newline = 0;
+
+    if (fd < 0 || out == NULL || out_sz < 2) {
+        return -1;
+    }
+
+    for (;;) {
+        unsigned char ch;
+        ssize_t n = read(fd, &ch, 1);
+        if (n == 0) {
+            break;
+        }
+        if (n < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            return -1;
+        }
+
+        if (ch == '\n') {
+            saw_newline = 1;
+            break;
+        }
+        if (ch == '\0') {
+            return -2;
+        }
+        if (len + 1 >= out_sz) {
+            return -3;
+        }
+
+        out[len++] = (char)ch;
+    }
+
+    out[len] = '\0';
+
+    if (len > 0 && out[len - 1] == '\r') {
+        out[len - 1] = '\0';
+    }
+
+    (void)saw_newline;
+    return 0;
+}
+
+static int replace_stdin_with_devnull(void) {
+    int null_fd = open("/dev/null", O_RDONLY);
+    int rc = 0;
+
+    if (null_fd < 0) {
+        return -1;
+    }
+
+    if (dup2(null_fd, STDIN_FILENO) < 0) {
+        rc = -1;
+    }
+
+    close(null_fd);
+    return rc;
+}
+
+static int load_mnemonic(mnemonic_state_t *mnemonic, const mnemonic_source_t *source) {
+    char phrase[MNEMONIC_MAX_LEN];
+    int rc = -1;
+
+    if (mnemonic == NULL || source == NULL) {
+        return -1;
+    }
+
+    if (source->kind == MNEMONIC_SOURCE_TUI) {
+        return prompt_load_mnemonic_tui(mnemonic);
+    }
+
+    memset(phrase, 0, sizeof(phrase));
+    rc = read_mnemonic_from_fd(source->fd, phrase, sizeof(phrase));
+    if (rc != 0) {
+        if (rc == -2) {
+            fprintf(stderr, "nsigner: mnemonic input contains embedded NUL byte\n");
+        } else if (rc == -3) {
+            fprintf(stderr, "nsigner: mnemonic input exceeded maximum length\n");
+        } else {
+            fprintf(stderr, "nsigner: failed to read mnemonic from fd %d: %s\n", source->fd, strerror(errno));
+        }
+        if (source->fd >= 0) {
+            close(source->fd);
+        }
+        secure_memzero(phrase, sizeof(phrase));
+        return -1;
+    }
+
+    rc = mnemonic_load(mnemonic, phrase);
+    secure_memzero(phrase, sizeof(phrase));
+    if (source->fd >= 0) {
+        close(source->fd);
+    }
+    if (rc != 0) {
+        fprintf(stderr, "nsigner: mnemonic validation failed\n");
+        return -1;
+    }
+
+    if (source->kind == MNEMONIC_SOURCE_STDIN || source->fd == STDIN_FILENO) {
+        if (replace_stdin_with_devnull() != 0) {
+            fprintf(stderr, "nsigner: failed to rebind stdin to /dev/null: %s\n", strerror(errno));
+            mnemonic_unload(mnemonic);
+            return -1;
+        }
+    }
+
+    printf("Seed phrase is valid and accepted.\n");
+    return 0;
+}
+
 static void apply_test_overrides(policy_table_t *policy) {
     const char *force_prompt;
     const char *noninteractive_prompt;
@@ -1018,6 +1480,10 @@ int main(int argc, char *argv[]) {
     int argi = 1;
     const char *preapprove_specs[POLICY_MAX_ENTRIES];
     int preapprove_count = 0;
+    int auth_mode = NSIGNER_AUTH_OFF;
+    int auth_skew_seconds = AUTH_DEFAULT_SKEW_SECONDS;
+    int allow_all = 0;
+    mnemonic_source_t mnemonic_source = { MNEMONIC_SOURCE_TUI, -1 };
 
     while (argi < argc) {
         if (strcmp(argv[argi], "--socket-name") == 0 ||
@@ -1032,7 +1498,7 @@ int main(int argc, char *argv[]) {
             argi += 2;
             continue;
         }
-        if (strcmp(argv[argi], "--listen") == 0) {
+        if (strcmp(argv[argi], "--listen") == 0 || strcmp(argv[argi], "-l") == 0) {
             if (argi + 1 >= argc) {
                 fprintf(stderr, "Missing value for %s\n", argv[argi]);
                 return 1;
@@ -1053,7 +1519,25 @@ int main(int argc, char *argv[]) {
             argi += 2;
             continue;
         }
-        if (strcmp(argv[argi], "--preapprove") == 0) {
+        if (strcmp(argv[argi], "--auth") == 0 || strcmp(argv[argi], "-a") == 0) {
+            if (argi + 1 >= argc) {
+                fprintf(stderr, "Missing value for %s\n", argv[argi]);
+                return 1;
+            }
+            if (strcmp(argv[argi + 1], "off") == 0) {
+                auth_mode = NSIGNER_AUTH_OFF;
+            } else if (strcmp(argv[argi + 1], "optional") == 0) {
+                auth_mode = NSIGNER_AUTH_OPTIONAL;
+            } else if (strcmp(argv[argi + 1], "required") == 0) {
+                auth_mode = NSIGNER_AUTH_REQUIRED;
+            } else {
+                fprintf(stderr, "Invalid --auth mode: %s (expected off|optional|required)\n", argv[argi + 1]);
+                return 1;
+            }
+            argi += 2;
+            continue;
+        }
+        if (strcmp(argv[argi], "--preapprove") == 0 || strcmp(argv[argi], "-p") == 0) {
             if (argi + 1 >= argc) {
                 fprintf(stderr, "Missing value for %s\n", argv[argi]);
                 return 1;
@@ -1066,6 +1550,43 @@ int main(int argc, char *argv[]) {
             argi += 2;
             continue;
         }
+        if (strcmp(argv[argi], "--mnemonic-stdin") == 0) {
+            if (mnemonic_source.kind != MNEMONIC_SOURCE_TUI) {
+                fprintf(stderr, "nsigner: --mnemonic-stdin and --mnemonic-fd are mutually exclusive\n");
+                return 1;
+            }
+            mnemonic_source.kind = MNEMONIC_SOURCE_STDIN;
+            mnemonic_source.fd = STDIN_FILENO;
+            argi += 1;
+            continue;
+        }
+        if (strcmp(argv[argi], "--mnemonic-fd") == 0) {
+            char *endp = NULL;
+            long parsed_fd;
+            if (argi + 1 >= argc) {
+                fprintf(stderr, "Missing value for %s\n", argv[argi]);
+                return 1;
+            }
+            if (mnemonic_source.kind != MNEMONIC_SOURCE_TUI) {
+                fprintf(stderr, "nsigner: --mnemonic-stdin and --mnemonic-fd are mutually exclusive\n");
+                return 1;
+            }
+            errno = 0;
+            parsed_fd = strtol(argv[argi + 1], &endp, 10);
+            if (errno != 0 || endp == argv[argi + 1] || *endp != '\0' || parsed_fd < 0 || parsed_fd > INT_MAX) {
+                fprintf(stderr, "nsigner: --mnemonic-fd %s: invalid FD value\n", argv[argi + 1]);
+                return 1;
+            }
+            mnemonic_source.kind = MNEMONIC_SOURCE_FD;
+            mnemonic_source.fd = (int)parsed_fd;
+            argi += 2;
+            continue;
+        }
+        if (strcmp(argv[argi], "--allow-all") == 0 || strcmp(argv[argi], "-A") == 0) {
+            allow_all = 1;
+            argi += 1;
+            continue;
+        }
         break;
     }
 
@@ -1101,11 +1622,30 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    if (mnemonic_source.kind == MNEMONIC_SOURCE_STDIN &&
+        (listen_mode == NSIGNER_LISTEN_STDIO || listen_mode == NSIGNER_LISTEN_QREXEC)) {
+        fprintf(stderr, "nsigner: --mnemonic-stdin requires --listen unix or --listen tcp:...\n");
+        return 1;
+    }
+    if (mnemonic_source.kind == MNEMONIC_SOURCE_FD) {
+        if (mnemonic_source.fd == STDOUT_FILENO) {
+            fprintf(stderr, "nsigner: --mnemonic-fd 1 is not allowed\n");
+            return 1;
+        }
+        if (mnemonic_source.fd == STDIN_FILENO &&
+            (listen_mode == NSIGNER_LISTEN_STDIO || listen_mode == NSIGNER_LISTEN_QREXEC)) {
+            fprintf(stderr, "nsigner: --mnemonic-fd 0 cannot be used with --listen stdio or --listen qrexec\n");
+            return 1;
+        }
+    }
+
     printf("nsigner %s\n", NSIGNER_VERSION);
     fflush(stdout);
 
+    g_startup_mnemonic_source_kind = mnemonic_source.kind;
+
     mnemonic_init(&mnemonic);
-    if (prompt_load_mnemonic(&mnemonic) != 0) {
+    if (load_mnemonic(&mnemonic, &mnemonic_source) != 0) {
         mnemonic_unload(&mnemonic);
         return 1;
     }
@@ -1153,6 +1693,9 @@ int main(int argc, char *argv[]) {
     }
 
     apply_test_overrides(&policy);
+    if (allow_all) {
+        server_set_prompt_always_allow(1);
+    }
 
     if (nostr_init() != 0) {
         fprintf(stderr, "Failed to initialize crypto subsystem\n");
@@ -1191,7 +1734,27 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
-    server_init(&server, listen_target, socket_name_explicit, listen_mode, &dispatcher, &policy);
+    if ((listen_mode == NSIGNER_LISTEN_UNIX || listen_mode == NSIGNER_LISTEN_STDIO) &&
+        auth_mode != NSIGNER_AUTH_OFF) {
+        fprintf(stderr, "--auth is currently supported only with --listen qrexec (optional/required) and tcp (required)\n");
+        crypto_wipe(&key_store);
+        nostr_cleanup();
+        mnemonic_unload(&mnemonic);
+        return 1;
+    }
+
+    if (listen_mode == NSIGNER_LISTEN_TCP) {
+        auth_mode = NSIGNER_AUTH_REQUIRED;
+    }
+
+    server_init(&server,
+                listen_target,
+                socket_name_explicit,
+                listen_mode,
+                auth_mode,
+                auth_skew_seconds,
+                &dispatcher,
+                &policy);
     if (server_start(&server) != 0) {
         if (listen_mode == NSIGNER_LISTEN_UNIX) {
             fprintf(stderr, "Failed to start server on @%s: %s\n", socket_name, server_last_error(&server));
@@ -1211,15 +1774,43 @@ int main(int argc, char *argv[]) {
     (void)signal(SIGINT, handle_signal);
     (void)signal(SIGTERM, handle_signal);
 
+    {
+        char fips_ipv6[128];
+        char fips_npub[256];
+        char listen_port[16];
+        int have_fips_identity =
+            (lookup_local_fips_identity(fips_ipv6, sizeof(fips_ipv6), fips_npub, sizeof(fips_npub)) == 0);
+
+        connection_info_clear();
+
         if (listen_mode == NSIGNER_LISTEN_UNIX) {
+            connection_info_add("listen: unix @%s", socket_name);
+            connection_info_add("client: nsigner --socket-name %s client '<json>'", socket_name);
             printf("System is ready and waiting for connections on @%s.\n", socket_name);
         } else if (listen_mode == NSIGNER_LISTEN_TCP) {
+            connection_info_add("listen: %s", listen_target);
             printf("System is ready and waiting for connections on %s.\n", listen_target);
         } else if (listen_mode == NSIGNER_LISTEN_QREXEC) {
+            connection_info_add("listen: qrexec");
             printf("System is ready and waiting for a qrexec request.\n");
         } else {
+            connection_info_add("listen: stdio");
             printf("System is ready and waiting for a stdio request.\n");
         }
+
+        if (have_fips_identity) {
+            connection_info_add("fips ipv6: %s", fips_ipv6);
+            connection_info_add("fips npub: %s", fips_npub);
+            printf("fips ipv6: %s\n", fips_ipv6);
+            printf("fips npub: %s\n", fips_npub);
+
+            if (listen_mode == NSIGNER_LISTEN_TCP &&
+                extract_listen_port(listen_target, listen_port, sizeof(listen_port)) == 0) {
+                connection_info_add("fips address: http://%s.fips:%s", fips_npub, listen_port);
+                printf("fips address: http://%s.fips:%s\n", fips_npub, listen_port);
+            }
+        }
+    }
     fflush(stdout);
 
     if (listen_mode == NSIGNER_LISTEN_STDIO || listen_mode == NSIGNER_LISTEN_QREXEC) {
@@ -1260,6 +1851,14 @@ int main(int argc, char *argv[]) {
     memset(&g_activity_log, 0, sizeof(g_activity_log));
     g_auto_approve = 0;
     server_set_prompt_always_allow(0);
+    {
+        main_tui_context_t main_tui_ctx;
+        main_tui_ctx.role_table = &role_table;
+        main_tui_ctx.mnemonic = &mnemonic;
+        main_tui_ctx.derived_count = &derived_count;
+        main_tui_ctx.socket_name = socket_name;
+        server_set_approval_cb(tui_approval_cb, &main_tui_ctx);
+        tui_install_resize_handler();
         render_status(&role_table, &mnemonic, derived_count, socket_name);
 
         pfds[0].fd = server.listen_fd;
@@ -1276,6 +1875,10 @@ int main(int argc, char *argv[]) {
                 break;
             }
 
+            if (tui_resize_pending()) {
+                render_status(&role_table, &mnemonic, derived_count, socket_name);
+            }
+
             if (prc > 0 && (pfds[0].revents & POLLIN)) {
                 int hrc = server_handle_one(&server, activity_log_cb, NULL);
                 if (hrc < 0) {
@@ -1297,11 +1900,21 @@ int main(int argc, char *argv[]) {
                         server_set_prompt_always_allow(g_auto_approve);
                         render_status(&role_table, &mnemonic, derived_count, socket_name);
                     } else if (lower == 'l') {
+                        mnemonic_source_t relock_source;
+
                         printf("\n[lock] Session locked. Re-enter mnemonic to unlock.\n");
                         fflush(stdout);
                         crypto_wipe(&key_store);
                         mnemonic_unload(&mnemonic);
-                    if (prompt_load_mnemonic(&mnemonic) != 0) {
+
+                        relock_source.kind = MNEMONIC_SOURCE_TUI;
+                        relock_source.fd = -1;
+                        if (g_startup_mnemonic_source_kind != MNEMONIC_SOURCE_TUI) {
+                            printf("[lock] Re-unlock uses terminal prompt in this session.\n");
+                            fflush(stdout);
+                        }
+
+                        if (load_mnemonic(&mnemonic, &relock_source) != 0) {
                             g_running = 0;
                         } else {
                             derived_count = crypto_derive_all(&key_store, &role_table, &mnemonic);
@@ -1315,6 +1928,9 @@ int main(int argc, char *argv[]) {
             }
         }
 
+        server_set_approval_cb(NULL, NULL);
+    }
+
     server_stop(&server);
     crypto_wipe(&key_store);
     nostr_cleanup();

src/mnemonic.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -384,7 +384,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

src/policy.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -384,7 +384,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

src/role_table.c

@@ -232,7 +232,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -387,7 +387,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

src/secure_mem.c

@@ -231,7 +231,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -386,7 +386,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

src/selector.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -384,7 +384,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

src/server.c

@@ -234,7 +234,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -397,14 +397,21 @@ char *dispatcher_handle_request(dispatcher_ctx_t *ctx, const char *json_request)
 #define NSIGNER_LISTEN_QREXEC 2
 #define NSIGNER_LISTEN_TCP    3
 
+#define NSIGNER_AUTH_OFF      0
+#define NSIGNER_AUTH_OPTIONAL 1
+#define NSIGNER_AUTH_REQUIRED 2
+
 /* Caller identity */
 typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
     int kind;
-    char caller_id[64];     /* "uid:<n>" or "qubes:<vm>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];     /* "uid:<n>", "qubes:<vm>", or "pubkey:<hex>" */
     char source_qube[64];
+    int auth_present;
+    char auth_pubkey_hex[65];
+    char auth_label[64];
 } caller_identity_t;
 
 /* Server context */
@@ -418,12 +425,16 @@ typedef struct {
     dispatcher_ctx_t *dispatcher;
     policy_table_t *policy;
     int socket_name_explicit;
+    int auth_mode;
+    int auth_skew_seconds;
 } server_ctx_t;
 
 /* Initialize server context. socket_name is the abstract namespace name (e.g. "nsigner").
  * socket_name_explicit should be non-zero when provided via --socket-name override. */
 void server_init(server_ctx_t *ctx, const char *socket_name, int socket_name_explicit,
                  int listen_mode,
+                 int auth_mode,
+                 int auth_skew_seconds,
                  dispatcher_ctx_t *dispatcher, policy_table_t *policy);
 
 /* Start listening. Returns 0 on success, -1 on error. */
@@ -443,6 +454,19 @@ void server_stop(server_ctx_t *ctx);
 /* Extract caller identity from connected fd */
 int server_get_caller(int fd, caller_identity_t *out);
 
+typedef struct {
+    const caller_identity_t *caller;
+    const char *method;
+    const char *role_name;
+    const char *purpose;
+    int pending_derivation;
+    const char *fips_peer_npub;
+    const char *fips_peer_name;
+} server_approval_request_t;
+
+typedef int (*server_approval_cb)(const server_approval_request_t *req, void *user_data);
+void server_set_approval_cb(server_approval_cb cb, void *user_data);
+
 
 /* from socket_name.h */
 
@@ -474,6 +498,8 @@ int socket_name_random(char *out, size_t out_len);
 int transport_send_framed(int fd, const char *payload);
 int transport_recv_framed(int fd, char **out_payload, size_t max_size);
 
+#include "auth_envelope.h"
+
 #include <arpa/inet.h>
 #include <ctype.h>
 #include <errno.h>
@@ -487,6 +513,10 @@ int transport_recv_framed(int fd, char **out_payload, size_t max_size);
 
 static int g_prompt_always_allow = 0;
 static int g_noninteractive_prompt_default = -1;
+static auth_nonce_cache_t g_auth_nonce_cache;
+static int g_auth_nonce_cache_inited = 0;
+static server_approval_cb g_approval_cb = NULL;
+static void *g_approval_cb_user_data = NULL;
 
 static int caller_id_extract_ipv6(const char *caller_id, char *out_ipv6, size_t out_sz) {
     const char *start;
@@ -651,6 +681,11 @@ void server_set_noninteractive_prompt_default(int decision) {
     }
 }
 
+void server_set_approval_cb(server_approval_cb cb, void *user_data) {
+    g_approval_cb = cb;
+    g_approval_cb_user_data = user_data;
+}
+
 static int prompt_for_policy_decision(const caller_identity_t *caller,
                                       const char *method,
                                       const char *role_name,
@@ -670,6 +705,32 @@ static int prompt_for_policy_decision(const caller_identity_t *caller,
         return POLICY_DENY;
     }
 
+    if (g_approval_cb != NULL) {
+        server_approval_request_t req;
+        char ipv6[INET6_ADDRSTRLEN];
+        char npub[128];
+        char display_name[128];
+
+        req.caller = caller;
+        req.method = method;
+        req.role_name = role_name;
+        req.purpose = purpose;
+        req.pending_derivation = pending_derivation;
+        req.fips_peer_npub = NULL;
+        req.fips_peer_name = NULL;
+
+        npub[0] = '\0';
+        display_name[0] = '\0';
+        if (caller != NULL && caller->kind == NSIGNER_LISTEN_TCP &&
+            caller_id_extract_ipv6(caller->caller_id, ipv6, sizeof(ipv6)) == 0 &&
+            lookup_fips_peer_for_ipv6(ipv6, npub, sizeof(npub), display_name, sizeof(display_name)) == 0) {
+            req.fips_peer_npub = (npub[0] != '\0') ? npub : NULL;
+            req.fips_peer_name = (display_name[0] != '\0') ? display_name : NULL;
+        }
+
+        return g_approval_cb(&req, g_approval_cb_user_data);
+    }
+
     printf("\nApproval required\n");
     printf("caller: %s\n", (caller != NULL) ? caller->caller_id : "unknown");
     if (caller != NULL && caller->kind == NSIGNER_LISTEN_TCP) {
@@ -677,6 +738,9 @@ static int prompt_for_policy_decision(const caller_identity_t *caller,
         char npub[128];
         char display_name[128];
 
+        npub[0] = '\0';
+        display_name[0] = '\0';
+
         if (caller_id_extract_ipv6(caller->caller_id, ipv6, sizeof(ipv6)) == 0 &&
             lookup_fips_peer_for_ipv6(ipv6, npub, sizeof(npub), display_name, sizeof(display_name)) == 0) {
             if (display_name[0] != '\0') {
@@ -686,6 +750,7 @@ static int prompt_for_policy_decision(const caller_identity_t *caller,
             }
         }
     }
+
     printf("method: %s\n", (method != NULL) ? method : "unknown");
     printf("role: %s\n", (role_name != NULL) ? role_name : "unknown");
     printf("purpose: %s\n", (purpose != NULL) ? purpose : "unknown");
@@ -825,6 +890,82 @@ static void json_copy_string(char *dst, size_t dst_sz, const char *src, const ch
     dst[dst_sz - 1] = '\0';
 }
 
+static int extract_request_id_compact(const char *json, char *out_id, size_t out_id_sz) {
+    cJSON *root;
+    cJSON *id_item;
+    char *printed = NULL;
+
+    if (json == NULL || out_id == NULL || out_id_sz == 0) {
+        return -1;
+    }
+
+    out_id[0] = '\0';
+    root = cJSON_Parse(json);
+    if (root == NULL) {
+        return -1;
+    }
+
+    id_item = cJSON_GetObjectItemCaseSensitive(root, "id");
+    if (id_item == NULL) {
+        cJSON_Delete(root);
+        return -1;
+    }
+
+    if (cJSON_IsString(id_item) && id_item->valuestring != NULL) {
+        json_copy_string(out_id, out_id_sz, id_item->valuestring, "null");
+        cJSON_Delete(root);
+        return 0;
+    }
+
+    printed = cJSON_PrintUnformatted(id_item);
+    if (printed != NULL) {
+        json_copy_string(out_id, out_id_sz, printed, "null");
+        free(printed);
+        cJSON_Delete(root);
+        return 0;
+    }
+
+    cJSON_Delete(root);
+    return -1;
+}
+
+static int request_has_auth_field(const char *json) {
+    cJSON *root;
+    cJSON *auth;
+    int has_auth;
+
+    if (json == NULL) {
+        return 0;
+    }
+
+    root = cJSON_Parse(json);
+    if (root == NULL) {
+        return 0;
+    }
+
+    auth = cJSON_GetObjectItemCaseSensitive(root, "auth");
+    has_auth = (auth != NULL) ? 1 : 0;
+    cJSON_Delete(root);
+    return has_auth;
+}
+
+static void caller_id_compose_with_pubkey(char *out,
+                                          size_t out_sz,
+                                          int caller_kind,
+                                          const char *source_qube,
+                                          const char *pubkey_hex) {
+    if (out == NULL || out_sz == 0 || pubkey_hex == NULL) {
+        return;
+    }
+
+    if (caller_kind == NSIGNER_LISTEN_QREXEC && source_qube != NULL && source_qube[0] != '\0') {
+        (void)snprintf(out, out_sz, "qubes:%s+pubkey:%s", source_qube, pubkey_hex);
+        return;
+    }
+
+    (void)snprintf(out, out_sz, "pubkey:%s", pubkey_hex);
+}
+
 static int extract_method_and_selector(const char *json,
                                        char *method,
                                        size_t method_sz,
@@ -888,6 +1029,8 @@ static int extract_method_and_selector(const char *json,
 
 void server_init(server_ctx_t *ctx, const char *socket_name, int socket_name_explicit,
                  int listen_mode,
+                 int auth_mode,
+                 int auth_skew_seconds,
                  dispatcher_ctx_t *dispatcher, policy_table_t *policy) {
     if (ctx == NULL) {
         return;
@@ -905,6 +1048,12 @@ void server_init(server_ctx_t *ctx, const char *socket_name, int socket_name_exp
     ctx->dispatcher = dispatcher;
     ctx->policy = policy;
     ctx->socket_name_explicit = socket_name_explicit ? 1 : 0;
+    ctx->auth_mode = auth_mode;
+    ctx->auth_skew_seconds = (auth_skew_seconds > 0) ? auth_skew_seconds : AUTH_DEFAULT_SKEW_SECONDS;
+    if (!g_auth_nonce_cache_inited) {
+        auth_nonce_cache_init(&g_auth_nonce_cache);
+        g_auth_nonce_cache_inited = 1;
+    }
 }
 
 int server_start(server_ctx_t *ctx) {
@@ -1195,6 +1344,9 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
     char *request = NULL;
     char *response = NULL;
     char method[64];
+    char request_id[128];
+    char auth_pubkey[65];
+    char auth_label[64];
     char role_name[ROLE_NAME_MAX];
     char purpose[ROLE_PURPOSE_MAX];
     selector_request_t selector_req;
@@ -1208,6 +1360,8 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
     char activity[256];
     const char *verdict = "DENIED";
     const char *source_label = "no-match";
+    int auth_err_code = 0;
+    const char *auth_err_msg = NULL;
 
     if (ctx == NULL || ctx->listen_fd < 0 || ctx->dispatcher == NULL || ctx->policy == NULL) {
         return -1;
@@ -1251,6 +1405,77 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
     json_copy_string(method, sizeof(method), "unknown", "unknown");
     json_copy_string(role_name, sizeof(role_name), "unknown", "unknown");
     json_copy_string(purpose, sizeof(purpose), "unknown", "unknown");
+    json_copy_string(request_id, sizeof(request_id), "null", "null");
+    auth_pubkey[0] = '\0';
+    auth_label[0] = '\0';
+
+    {
+        int auth_required = 0;
+        int auth_optional = 0;
+        int has_auth_field = 0;
+
+        if (caller.kind == NSIGNER_LISTEN_TCP) {
+            auth_required = 1;
+        } else if (caller.kind == NSIGNER_LISTEN_QREXEC) {
+            if (ctx->auth_mode == NSIGNER_AUTH_REQUIRED) {
+                auth_required = 1;
+            } else if (ctx->auth_mode == NSIGNER_AUTH_OPTIONAL) {
+                auth_optional = 1;
+            }
+        }
+
+        has_auth_field = request_has_auth_field(request);
+        if (auth_required || (auth_optional && has_auth_field)) {
+            if (auth_envelope_verify_request(request,
+                                             &g_auth_nonce_cache,
+                                             ctx->auth_skew_seconds,
+                                             auth_pubkey,
+                                             sizeof(auth_pubkey),
+                                             auth_label,
+                                             sizeof(auth_label),
+                                             &auth_err_code,
+                                             &auth_err_msg) != 0) {
+                (void)extract_request_id_compact(request, request_id, sizeof(request_id));
+                if (auth_err_msg == NULL) {
+                    auth_err_msg = "auth_envelope_malformed";
+                }
+                {
+                    char errbuf[256];
+                    (void)snprintf(errbuf,
+                                   sizeof(errbuf),
+                                   "{\"id\":\"%s\",\"error\":{\"code\":%d,\"message\":\"%s\"}}",
+                                   request_id,
+                                   (auth_err_code != 0) ? auth_err_code : AUTH_ERR_ENVELOPE_MALFORMED,
+                                   auth_err_msg);
+                    response = strdup(errbuf);
+                }
+                if (response != NULL) {
+                    (void)transport_send_framed((client_fd == STDIN_FILENO) ? STDOUT_FILENO : client_fd, response);
+                    free(response);
+                }
+                free(request);
+                if (client_fd != STDIN_FILENO) {
+                    close(client_fd);
+                }
+                return 1;
+            }
+
+            caller.auth_present = 1;
+            json_copy_string(caller.auth_pubkey_hex,
+                             sizeof(caller.auth_pubkey_hex),
+                             auth_pubkey,
+                             "");
+            json_copy_string(caller.auth_label,
+                             sizeof(caller.auth_label),
+                             auth_label,
+                             "");
+            caller_id_compose_with_pubkey(caller.caller_id,
+                                          sizeof(caller.caller_id),
+                                          caller.kind,
+                                          caller.source_qube,
+                                          auth_pubkey);
+        }
+    }
 
     if (extract_method_and_selector(request, method, sizeof(method), &selector_req) == 0) {
         if (ctx->dispatcher->role_table != NULL) {

src/socket_name.c

@@ -231,7 +231,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -386,7 +386,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

tests/test.sh

@@ -172,5 +172,13 @@ else
   echo "[warn] no @nsigner entries found"
 fi
 
+echo
+echo "[extra] mnemonic startup input tests"
+if [[ -x ./build/test_mnemonic_input ]]; then
+  ./build/test_mnemonic_input || true
+else
+  echo "[warn] build/test_mnemonic_input not found (run: make test-mnemonic-input)"
+fi
+
 echo
 echo "Smoke test complete."

tests/test_auth_envelope.c

@@ -0,0 +1,227 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include <cJSON.h>
+#include <nostr_core/nip001.h>
+#include <nostr_core/utils.h>
+
+#include "../src/auth_envelope.h"
+
+static int g_failures = 0;
+
+static void check_condition(const char *name, int ok) {
+    if (ok) {
+        printf("[PASS] %s\n", name);
+    } else {
+        printf("[FAIL] %s\n", name);
+        g_failures++;
+    }
+}
+
+static int compute_params_hash_hex(cJSON *params, char out_hex[65]) {
+    char *compact;
+    unsigned char hash[32];
+
+    if (params == NULL || out_hex == NULL) {
+        return -1;
+    }
+
+    compact = cJSON_PrintUnformatted(params);
+    if (compact == NULL) {
+        return -1;
+    }
+
+    if (nostr_sha256((const unsigned char *)compact, strlen(compact), hash) != 0) {
+        free(compact);
+        return -1;
+    }
+
+    nostr_bytes_to_hex(hash, 32, out_hex);
+    out_hex[64] = '\0';
+    free(compact);
+    return 0;
+}
+
+static cJSON *tag_pair(const char *k, const char *v) {
+    cJSON *arr = cJSON_CreateArray();
+    cJSON_AddItemToArray(arr, cJSON_CreateString(k));
+    cJSON_AddItemToArray(arr, cJSON_CreateString(v));
+    return arr;
+}
+
+static char *make_request_json(const unsigned char privkey[32],
+                               const char *req_id,
+                               const char *method,
+                               int created_at) {
+    cJSON *params = cJSON_CreateArray();
+    cJSON *options = cJSON_CreateObject();
+    cJSON *tags = cJSON_CreateArray();
+    cJSON *auth;
+    cJSON *root;
+    char body_hash[65];
+    char *out;
+
+    cJSON_AddItemToArray(params, cJSON_CreateString("{\"kind\":1,\"content\":\"x\",\"tags\":[],\"created_at\":1700000000}"));
+    cJSON_AddStringToObject(options, "role", "main");
+    cJSON_AddItemToArray(params, options);
+
+    if (compute_params_hash_hex(params, body_hash) != 0) {
+        cJSON_Delete(params);
+        return NULL;
+    }
+
+    cJSON_AddItemToArray(tags, tag_pair("nsigner_rpc", req_id));
+    cJSON_AddItemToArray(tags, tag_pair("nsigner_method", method));
+    cJSON_AddItemToArray(tags, tag_pair("nsigner_body_hash", body_hash));
+
+    auth = nostr_create_and_sign_event(AUTH_EVENT_KIND, "test-client", tags, privkey, (time_t)created_at);
+    if (auth == NULL) {
+        cJSON_Delete(params);
+        return NULL;
+    }
+
+    root = cJSON_CreateObject();
+    cJSON_AddStringToObject(root, "id", req_id);
+    cJSON_AddStringToObject(root, "method", method);
+    cJSON_AddItemToObject(root, "params", params);
+    cJSON_AddItemToObject(root, "auth", auth);
+
+    out = cJSON_PrintUnformatted(root);
+    cJSON_Delete(root);
+    return out;
+}
+
+int main(void) {
+    auth_nonce_cache_t cache;
+    unsigned char privkey[32] = {
+        0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
+    };
+    char pubkey_hex[65];
+    char label[64];
+    const char *err_msg = NULL;
+    int err_code = 0;
+    char *req;
+
+    check_condition("nostr_crypto_init", nostr_crypto_init() == 0);
+    auth_nonce_cache_init(&cache);
+
+    req = make_request_json(privkey, "req-1", "sign_event", (int)time(NULL));
+    check_condition("build valid request", req != NULL);
+    if (req != NULL) {
+        check_condition("valid auth envelope accepted",
+            auth_envelope_verify_request(req,
+                                         &cache,
+                                         AUTH_DEFAULT_SKEW_SECONDS,
+                                         pubkey_hex,
+                                         sizeof(pubkey_hex),
+                                         label,
+                                         sizeof(label),
+                                         &err_code,
+                                         &err_msg) == 0);
+
+        check_condition("pubkey output length 64", strlen(pubkey_hex) == 64);
+        free(req);
+    }
+
+    check_condition("missing auth rejected with required code",
+        auth_envelope_verify_request("{\"id\":\"x\",\"method\":\"get_public_key\",\"params\":[]}",
+                                     &cache,
+                                     AUTH_DEFAULT_SKEW_SECONDS,
+                                     pubkey_hex,
+                                     sizeof(pubkey_hex),
+                                     label,
+                                     sizeof(label),
+                                     &err_code,
+                                     &err_msg) != 0 &&
+        err_code == AUTH_ERR_ENVELOPE_REQUIRED);
+
+    req = make_request_json(privkey, "req-2", "get_public_key", (int)time(NULL));
+    check_condition("build second request", req != NULL);
+    if (req != NULL) {
+        cJSON *root = cJSON_Parse(req);
+        cJSON *method_item;
+        char *tampered;
+
+        check_condition("parse second request", root != NULL);
+        method_item = (root != NULL) ? cJSON_GetObjectItemCaseSensitive(root, "method") : NULL;
+        if (method_item != NULL) {
+            cJSON_SetValuestring(method_item, "sign_event");
+        }
+        tampered = (root != NULL) ? cJSON_PrintUnformatted(root) : NULL;
+        cJSON_Delete(root);
+
+        check_condition("tamper method mismatch rejected",
+            tampered != NULL &&
+            auth_envelope_verify_request(tampered,
+                                         &cache,
+                                         AUTH_DEFAULT_SKEW_SECONDS,
+                                         pubkey_hex,
+                                         sizeof(pubkey_hex),
+                                         label,
+                                         sizeof(label),
+                                         &err_code,
+                                         &err_msg) != 0 &&
+            err_code == AUTH_ERR_ENVELOPE_MISMATCH);
+
+        free(tampered);
+        free(req);
+    }
+
+    req = make_request_json(privkey, "req-3", "sign_event", (int)time(NULL));
+    check_condition("build replay request", req != NULL);
+    if (req != NULL) {
+        int first_ok = auth_envelope_verify_request(req,
+                                                    &cache,
+                                                    AUTH_DEFAULT_SKEW_SECONDS,
+                                                    pubkey_hex,
+                                                    sizeof(pubkey_hex),
+                                                    label,
+                                                    sizeof(label),
+                                                    &err_code,
+                                                    &err_msg);
+        int second_ok = auth_envelope_verify_request(req,
+                                                     &cache,
+                                                     AUTH_DEFAULT_SKEW_SECONDS,
+                                                     pubkey_hex,
+                                                     sizeof(pubkey_hex),
+                                                     label,
+                                                     sizeof(label),
+                                                     &err_code,
+                                                     &err_msg);
+        check_condition("first replay request accepted", first_ok == 0);
+        check_condition("second replay request rejected", second_ok != 0 && err_code == AUTH_ERR_REPLAY_DETECTED);
+        free(req);
+    }
+
+    req = make_request_json(privkey, "req-4", "sign_event", (int)time(NULL) - 1000);
+    check_condition("build stale request", req != NULL);
+    if (req != NULL) {
+        check_condition("stale request rejected",
+            auth_envelope_verify_request(req,
+                                         &cache,
+                                         AUTH_DEFAULT_SKEW_SECONDS,
+                                         pubkey_hex,
+                                         sizeof(pubkey_hex),
+                                         label,
+                                         sizeof(label),
+                                         &err_code,
+                                         &err_msg) != 0 &&
+            err_code == AUTH_ERR_ENVELOPE_STALE);
+        free(req);
+    }
+
+    nostr_crypto_cleanup();
+
+    if (g_failures == 0) {
+        printf("ALL TESTS PASSED\n");
+        return 0;
+    }
+
+    printf("TESTS FAILED: %d\n", g_failures);
+    return 1;
+}

tests/test_dispatcher.c

@@ -232,7 +232,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -390,7 +390,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

tests/test_enforcement.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -384,7 +384,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

tests/test_integration.c

@@ -231,7 +231,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -386,7 +386,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */
@@ -464,6 +464,8 @@ int socket_name_random(char *out, size_t out_len);
 #include <time.h>
 #include <unistd.h>
 
+#include "nsigner_client.h"
+
 #define SOCKET_NAME_A "nsigner_test_run_a"
 #define SOCKET_NAME_B "nsigner_test_run_b"
 #define MAX_MSG_SIZE 65536
@@ -630,6 +632,8 @@ int main(void) {
     char *resp = NULL;
     int status;
 
+    (void)signal(SIGPIPE, SIG_IGN);
+
     if (pipe(stdin_pipe) != 0) {
         perror("pipe");
         return 1;
@@ -704,7 +708,11 @@ int main(void) {
 
     sleep_ms(1000);
 
-    if (request_roundtrip_to(SOCKET_NAME_A, "{\"id\":\"1\",\"method\":\"get_public_key\",\"params\":[\"\"]}", &resp) == 0) {
+    {
+        nsigner_client_t client;
+        nsigner_client_init(&client);
+        if (nsigner_client_connect_unix(&client, SOCKET_NAME_A, 5000) == 0) {
+            if (nsigner_client_get_public_key(&client, "1", "", &resp) == 0) {
                 check_condition("get_public_key response id", strstr(resp, "\"id\":\"1\"") != NULL);
                 check_condition("get_public_key has result", strstr(resp, "\"result\":") != NULL);
             } else {
@@ -712,34 +720,45 @@ int main(void) {
             }
             free(resp);
             resp = NULL;
+            nsigner_client_close(&client);
+        } else {
+            check_condition("connect signer socket for client library", 0);
+        }
 
-    if (request_roundtrip_to(SOCKET_NAME_A, "{\"id\":\"2\",\"method\":\"sign_event\",\"params\":[\"{\\\"kind\\\":1,\\\"content\\\":\\\"hello\\\",\\\"tags\\\":[],\\\"created_at\\\":1700000000}\",{\"role\":\"main\"}]}", &resp) == 0) {
+        nsigner_client_init(&client);
+        if (nsigner_client_connect_unix(&client, SOCKET_NAME_A, 5000) == 0) {
+            if (nsigner_client_sign_event(&client,
+                                          "2",
+                                          "{\"kind\":1,\"content\":\"hello\",\"tags\":[],\"created_at\":1700000000}",
+                                          "main",
+                                          &resp) == 0) {
                 check_condition("sign_event response id", strstr(resp, "\"id\":\"2\"") != NULL);
                 check_condition("sign_event has result", strstr(resp, "\"result\":") != NULL);
             } else {
                 check_condition("sign_event request roundtrip", 0);
             }
             free(resp);
+            resp = NULL;
+        } else {
+            check_condition("connect signer socket for sign_event", 0);
+        }
+        nsigner_client_close(&client);
+    }
 
 
     {
         char *resp_a = NULL;
-        char *resp_b = NULL;
         char pub_a[65] = {0};
-        char pub_b[65] = {0};
         char cipher[2048] = {0};
         char req[4096];
         const char *p;
 
-        if (request_roundtrip_to(SOCKET_NAME_A, "{\"id\":\"3\",\"method\":\"get_public_key\",\"params\":[\"\"]}", &resp_a) == 0 &&
-            request_roundtrip_to(SOCKET_NAME_B, "{\"id\":\"4\",\"method\":\"get_public_key\",\"params\":[\"\"]}", &resp_b) == 0) {
+        if (request_roundtrip_to(SOCKET_NAME_A, "{\"id\":\"3\",\"method\":\"get_public_key\",\"params\":[\"\"]}", &resp_a) == 0) {
             p = strstr(resp_a, "\"result\":\"");
             if (p) { p += 10; strncpy(pub_a, p, 64); pub_a[64]='\0'; }
-            p = strstr(resp_b, "\"result\":\"");
-            if (p) { p += 10; strncpy(pub_b, p, 64); pub_b[64]='\0'; }
-            check_condition("multi-instance distinct sockets respond", pub_a[0] && pub_b[0]);
+            check_condition("single-instance public key request", pub_a[0] != '\0');
 
-            snprintf(req, sizeof(req), "{\"id\":\"5\",\"method\":\"nip04_encrypt\",\"params\":[\"%s\",\"hello_nip04\"]}", pub_b);
+            snprintf(req, sizeof(req), "{\"id\":\"5\",\"method\":\"nip04_encrypt\",\"params\":[\"%s\",\"hello_nip04\"]}", pub_a);
             free(resp_a); resp_a = NULL;
             if (request_roundtrip_to(SOCKET_NAME_A, req, &resp_a) == 0) {
                 p = strstr(resp_a, "\"result\":\"");
@@ -750,9 +769,9 @@ int main(void) {
                     cipher[i]='\0';
                 }
                 snprintf(req, sizeof(req), "{\"id\":\"6\",\"method\":\"nip04_decrypt\",\"params\":[\"%s\",\"%s\"]}", pub_a, cipher);
-                free(resp_b); resp_b = NULL;
-                if (request_roundtrip_to(SOCKET_NAME_B, req, &resp_b) == 0) {
-                    check_condition("nip04 round-trip plaintext recovered", strstr(resp_b, "hello_nip04") != NULL);
+                free(resp_a); resp_a = NULL;
+                if (request_roundtrip_to(SOCKET_NAME_A, req, &resp_a) == 0) {
+                    check_condition("nip04 round-trip plaintext recovered", strstr(resp_a, "hello_nip04") != NULL);
                 } else {
                     check_condition("nip04 decrypt request roundtrip", 0);
                 }
@@ -761,7 +780,7 @@ int main(void) {
             }
 
             memset(cipher, 0, sizeof(cipher));
-            snprintf(req, sizeof(req), "{\"id\":\"7\",\"method\":\"nip44_encrypt\",\"params\":[\"%s\",\"hello_nip44\"]}", pub_b);
+            snprintf(req, sizeof(req), "{\"id\":\"7\",\"method\":\"nip44_encrypt\",\"params\":[\"%s\",\"hello_nip44\"]}", pub_a);
             free(resp_a); resp_a = NULL;
             if (request_roundtrip_to(SOCKET_NAME_A, req, &resp_a) == 0) {
                 p = strstr(resp_a, "\"result\":\"");
@@ -772,9 +791,9 @@ int main(void) {
                     cipher[i]='\0';
                 }
                 snprintf(req, sizeof(req), "{\"id\":\"8\",\"method\":\"nip44_decrypt\",\"params\":[\"%s\",\"%s\"]}", pub_a, cipher);
-                free(resp_b); resp_b = NULL;
-                if (request_roundtrip_to(SOCKET_NAME_B, req, &resp_b) == 0) {
-                    check_condition("nip44 round-trip plaintext recovered", strstr(resp_b, "hello_nip44") != NULL);
+                free(resp_a); resp_a = NULL;
+                if (request_roundtrip_to(SOCKET_NAME_A, req, &resp_a) == 0) {
+                    check_condition("nip44 round-trip plaintext recovered", strstr(resp_a, "hello_nip44") != NULL);
                 } else {
                     check_condition("nip44 decrypt request roundtrip", 0);
                 }
@@ -782,10 +801,9 @@ int main(void) {
                 check_condition("nip44 encrypt request roundtrip", 0);
             }
         } else {
-            check_condition("multi-instance public key requests", 0);
+            check_condition("single-instance public key request", 0);
         }
         free(resp_a);
-        free(resp_b);
     }
 
     if (kill(child, SIGTERM) == 0) {

tests/test_mnemonic.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -384,7 +384,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

tests/test_mnemonic_input.c

@@ -0,0 +1,532 @@
+#define _GNU_SOURCE
+
+#include <arpa/inet.h>
+#include <errno.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/un.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+#define VALID_MNEMONIC "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
+#define LONG_INPUT_LEN 1024
+
+static int g_failures = 0;
+
+static void check_condition(const char *name, int condition) {
+    if (condition) {
+        printf("PASS: %s\n", name);
+    } else {
+        printf("FAIL: %s\n", name);
+        g_failures++;
+    }
+}
+
+static int sleep_ms(int ms) {
+    struct timespec ts;
+    ts.tv_sec = ms / 1000;
+    ts.tv_nsec = (long)(ms % 1000) * 1000000L;
+    return nanosleep(&ts, NULL);
+}
+
+static int write_full(int fd, const void *buf, size_t len) {
+    const unsigned char *p = (const unsigned char *)buf;
+    size_t off = 0;
+
+    while (off < len) {
+        ssize_t n = write(fd, p + off, len - off);
+        if (n < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            return -1;
+        }
+        off += (size_t)n;
+    }
+
+    return 0;
+}
+
+static int connect_socket_retry(const char *name, int timeout_ms) {
+    int elapsed = 0;
+
+    while (elapsed < timeout_ms) {
+        int fd;
+        struct sockaddr_un addr;
+        socklen_t addr_len;
+
+        fd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (fd < 0) {
+            return -1;
+        }
+
+        memset(&addr, 0, sizeof(addr));
+        addr.sun_family = AF_UNIX;
+        addr.sun_path[0] = '\0';
+        strncpy(&addr.sun_path[1], name, sizeof(addr.sun_path) - 2);
+        addr.sun_path[sizeof(addr.sun_path) - 1] = '\0';
+        addr_len = (socklen_t)(sizeof(sa_family_t) + 1 + strlen(name));
+
+        if (connect(fd, (struct sockaddr *)&addr, addr_len) == 0) {
+            return fd;
+        }
+
+        close(fd);
+        sleep_ms(100);
+        elapsed += 100;
+    }
+
+    return -1;
+}
+
+static pid_t spawn_with_stdin_and_fd(const char *const argv[],
+                                     const char *stdin_data,
+                                     int close_stdin_after_write,
+                                     const char *fd_data,
+                                     int fd_num,
+                                     int close_fd_after_write,
+                                     int *stdin_write_end,
+                                     int *fd_write_end,
+                                     int *capture_read_end) {
+    int stdin_pipe[2] = {-1, -1};
+    int fd_pipe[2] = {-1, -1};
+    int capture_pipe[2] = {-1, -1};
+    pid_t child;
+
+    if (pipe(stdin_pipe) != 0) {
+        return -1;
+    }
+    if (pipe(capture_pipe) != 0) {
+        close(stdin_pipe[0]);
+        close(stdin_pipe[1]);
+        return -1;
+    }
+    if (fd_data != NULL) {
+        if (pipe(fd_pipe) != 0) {
+            close(stdin_pipe[0]);
+            close(stdin_pipe[1]);
+            close(capture_pipe[0]);
+            close(capture_pipe[1]);
+            return -1;
+        }
+    }
+
+    child = fork();
+    if (child < 0) {
+        close(stdin_pipe[0]);
+        close(stdin_pipe[1]);
+        close(capture_pipe[0]);
+        close(capture_pipe[1]);
+        if (fd_pipe[0] >= 0) close(fd_pipe[0]);
+        if (fd_pipe[1] >= 0) close(fd_pipe[1]);
+        return -1;
+    }
+
+    if (child == 0) {
+        dup2(stdin_pipe[0], STDIN_FILENO);
+        dup2(capture_pipe[1], STDOUT_FILENO);
+        dup2(capture_pipe[1], STDERR_FILENO);
+
+        close(stdin_pipe[0]);
+        close(stdin_pipe[1]);
+        close(capture_pipe[0]);
+        close(capture_pipe[1]);
+
+        if (fd_data != NULL) {
+            dup2(fd_pipe[0], fd_num);
+            close(fd_pipe[0]);
+            close(fd_pipe[1]);
+        }
+
+        execv("./build/nsigner", (char *const *)argv);
+        _exit(127);
+    }
+
+    close(stdin_pipe[0]);
+    close(capture_pipe[1]);
+
+    if (fd_data != NULL) {
+        close(fd_pipe[0]);
+    }
+
+    if (stdin_data != NULL) {
+        (void)write_full(stdin_pipe[1], stdin_data, strlen(stdin_data));
+        if (close_stdin_after_write) {
+            close(stdin_pipe[1]);
+            stdin_pipe[1] = -1;
+        }
+    }
+
+    if (fd_data != NULL) {
+        (void)write_full(fd_pipe[1], fd_data, strlen(fd_data));
+        if (close_fd_after_write) {
+            close(fd_pipe[1]);
+            fd_pipe[1] = -1;
+        }
+    }
+
+    if (stdin_write_end != NULL) {
+        *stdin_write_end = stdin_pipe[1];
+    } else if (stdin_pipe[1] >= 0) {
+        close(stdin_pipe[1]);
+    }
+
+    if (fd_write_end != NULL) {
+        *fd_write_end = fd_pipe[1];
+    } else if (fd_pipe[1] >= 0) {
+        close(fd_pipe[1]);
+    }
+
+    if (capture_read_end != NULL) {
+        *capture_read_end = capture_pipe[0];
+    } else {
+        close(capture_pipe[0]);
+    }
+
+    return child;
+}
+
+static int read_capture_nonblocking(int fd, char *buf, size_t buf_sz) {
+    ssize_t n;
+    if (buf == NULL || buf_sz == 0) {
+        return -1;
+    }
+    n = read(fd, buf, buf_sz - 1);
+    if (n < 0) {
+        if (errno == EAGAIN || errno == EWOULDBLOCK) {
+            buf[0] = '\0';
+            return 0;
+        }
+        return -1;
+    }
+    buf[n] = '\0';
+    return 0;
+}
+
+static int wait_exit_timeout(pid_t pid, int timeout_ms, int *status) {
+    int elapsed = 0;
+    while (elapsed < timeout_ms) {
+        pid_t rc = waitpid(pid, status, WNOHANG);
+        if (rc == pid) {
+            return 0;
+        }
+        if (rc < 0) {
+            return -1;
+        }
+        sleep_ms(50);
+        elapsed += 50;
+    }
+    return -1;
+}
+
+static void test_stdin_happy_path(void) {
+    const char *const argv[] = {
+        "./build/nsigner", "--socket-name", "nsigner_test_mi_stdin_ok", "--mnemonic-stdin", NULL
+    };
+    int cap_fd = -1;
+    int status = 0;
+    int fd;
+    pid_t child = spawn_with_stdin_and_fd(argv,
+                                          VALID_MNEMONIC "\n",
+                                          1,
+                                          NULL,
+                                          -1,
+                                          0,
+                                          NULL,
+                                          NULL,
+                                          &cap_fd);
+
+    check_condition("spawn --mnemonic-stdin happy-path child", child > 0);
+    if (child <= 0) {
+        return;
+    }
+
+    fd = connect_socket_retry("nsigner_test_mi_stdin_ok", 5000);
+    check_condition("--mnemonic-stdin reaches running server", fd >= 0);
+    if (fd >= 0) {
+        close(fd);
+    }
+
+    (void)kill(child, SIGTERM);
+    (void)waitpid(child, &status, 0);
+    if (cap_fd >= 0) {
+        close(cap_fd);
+    }
+}
+
+static void test_stdin_eof_without_newline(void) {
+    const char *const argv[] = {
+        "./build/nsigner", "--socket-name", "nsigner_test_mi_stdin_eof", "--mnemonic-stdin", NULL
+    };
+    int cap_fd = -1;
+    int status = 0;
+    int fd;
+    pid_t child = spawn_with_stdin_and_fd(argv,
+                                          VALID_MNEMONIC,
+                                          1,
+                                          NULL,
+                                          -1,
+                                          0,
+                                          NULL,
+                                          NULL,
+                                          &cap_fd);
+
+    check_condition("spawn --mnemonic-stdin EOF-without-newline child", child > 0);
+    if (child <= 0) {
+        return;
+    }
+
+    fd = connect_socket_retry("nsigner_test_mi_stdin_eof", 5000);
+    check_condition("--mnemonic-stdin EOF without newline accepted", fd >= 0);
+    if (fd >= 0) {
+        close(fd);
+    }
+
+    (void)kill(child, SIGTERM);
+    (void)waitpid(child, &status, 0);
+    if (cap_fd >= 0) {
+        close(cap_fd);
+    }
+}
+
+static void test_stdin_invalid_mnemonic(void) {
+    const char *const argv[] = {
+        "./build/nsigner", "--mnemonic-stdin", NULL
+    };
+    int cap_fd = -1;
+    int status = 0;
+    char cap[512];
+    pid_t child = spawn_with_stdin_and_fd(argv,
+                                          "not a valid mnemonic\n",
+                                          1,
+                                          NULL,
+                                          -1,
+                                          0,
+                                          NULL,
+                                          NULL,
+                                          &cap_fd);
+
+    check_condition("spawn --mnemonic-stdin invalid child", child > 0);
+    if (child <= 0) {
+        return;
+    }
+
+    check_condition("--mnemonic-stdin invalid exits", wait_exit_timeout(child, 2000, &status) == 0);
+    check_condition("--mnemonic-stdin invalid exits non-zero", WIFEXITED(status) && WEXITSTATUS(status) != 0);
+
+    if (cap_fd >= 0) {
+        (void)read_capture_nonblocking(cap_fd, cap, sizeof(cap));
+        check_condition("--mnemonic-stdin invalid emits validation failure", strstr(cap, "mnemonic validation failed") != NULL);
+        close(cap_fd);
+    }
+}
+
+static void test_stdin_overflow(void) {
+    const char *const argv[] = {
+        "./build/nsigner", "--mnemonic-stdin", NULL
+    };
+    char long_input[LONG_INPUT_LEN + 2];
+    int i;
+    int cap_fd = -1;
+    int status = 0;
+    char cap[512];
+    pid_t child;
+
+    for (i = 0; i < LONG_INPUT_LEN; ++i) {
+        long_input[i] = 'a';
+    }
+    long_input[LONG_INPUT_LEN] = '\n';
+    long_input[LONG_INPUT_LEN + 1] = '\0';
+
+    child = spawn_with_stdin_and_fd(argv,
+                                    long_input,
+                                    1,
+                                    NULL,
+                                    -1,
+                                    0,
+                                    NULL,
+                                    NULL,
+                                    &cap_fd);
+
+    check_condition("spawn --mnemonic-stdin overflow child", child > 0);
+    if (child <= 0) {
+        return;
+    }
+
+    check_condition("--mnemonic-stdin overflow exits", wait_exit_timeout(child, 2000, &status) == 0);
+    check_condition("--mnemonic-stdin overflow exits non-zero", WIFEXITED(status) && WEXITSTATUS(status) != 0);
+
+    if (cap_fd >= 0) {
+        (void)read_capture_nonblocking(cap_fd, cap, sizeof(cap));
+        check_condition("--mnemonic-stdin overflow emits length error", strstr(cap, "exceeded maximum length") != NULL);
+        close(cap_fd);
+    }
+}
+
+static void test_fd_happy_path(void) {
+    const char *const argv[] = {
+        "./build/nsigner", "--socket-name", "nsigner_test_mi_fd_ok", "--mnemonic-fd", "3", NULL
+    };
+    int cap_fd = -1;
+    int status = 0;
+    int fd;
+    pid_t child = spawn_with_stdin_and_fd(argv,
+                                          "",
+                                          0,
+                                          VALID_MNEMONIC "\n",
+                                          3,
+                                          1,
+                                          NULL,
+                                          NULL,
+                                          &cap_fd);
+
+    check_condition("spawn --mnemonic-fd happy-path child", child > 0);
+    if (child <= 0) {
+        return;
+    }
+
+    fd = connect_socket_retry("nsigner_test_mi_fd_ok", 5000);
+    check_condition("--mnemonic-fd reaches running server", fd >= 0);
+    if (fd >= 0) {
+        close(fd);
+    }
+
+    (void)kill(child, SIGTERM);
+    (void)waitpid(child, &status, 0);
+    if (cap_fd >= 0) {
+        close(cap_fd);
+    }
+}
+
+static void test_mutual_exclusion_and_validation_errors(void) {
+    struct {
+        const char *name;
+        const char *const *argv;
+        const char *expect_substr;
+    } cases[] = {
+        {
+            "mutual exclusion stdin+fd",
+            (const char *const[]){"./build/nsigner", "--mnemonic-stdin", "--mnemonic-fd", "3", NULL},
+            "mutually exclusive"
+        },
+        {
+            "stdin with stdio listener",
+            (const char *const[]){"./build/nsigner", "--listen", "stdio", "--mnemonic-stdin", NULL},
+            "requires --listen unix or --listen tcp"
+        },
+        {
+            "mnemonic-fd 1 rejected",
+            (const char *const[]){"./build/nsigner", "--mnemonic-fd", "1", NULL},
+            "--mnemonic-fd 1 is not allowed"
+        },
+        {
+            "mnemonic-fd 0 rejected with stdio",
+            (const char *const[]){"./build/nsigner", "--listen", "stdio", "--mnemonic-fd", "0", NULL},
+            "cannot be used with --listen stdio"
+        }
+    };
+
+    size_t i;
+    for (i = 0; i < sizeof(cases) / sizeof(cases[0]); ++i) {
+        int cap_fd = -1;
+        int status = 0;
+        char cap[512];
+        pid_t child = spawn_with_stdin_and_fd(cases[i].argv,
+                                              "",
+                                              1,
+                                              NULL,
+                                              -1,
+                                              0,
+                                              NULL,
+                                              NULL,
+                                              &cap_fd);
+
+        check_condition(cases[i].name, child > 0);
+        if (child <= 0) {
+            continue;
+        }
+
+        check_condition("expected parse-time failure exits", wait_exit_timeout(child, 2000, &status) == 0);
+        check_condition("expected parse-time failure non-zero", WIFEXITED(status) && WEXITSTATUS(status) != 0);
+
+        if (cap_fd >= 0) {
+            (void)read_capture_nonblocking(cap_fd, cap, sizeof(cap));
+            check_condition("expected parse-time error message", strstr(cap, cases[i].expect_substr) != NULL);
+            close(cap_fd);
+        }
+    }
+}
+
+static void test_lock_reunlock_falls_back_to_tui_after_fd_startup(void) {
+    const char *const argv[] = {
+        "./build/nsigner", "--socket-name", "nsigner_test_mi_lock", "--mnemonic-fd", "3", NULL
+    };
+    int stdin_write = -1;
+    int cap_fd = -1;
+    int status = 0;
+    int fd;
+    pid_t child = spawn_with_stdin_and_fd(argv,
+                                          "",
+                                          0,
+                                          VALID_MNEMONIC "\n",
+                                          3,
+                                          1,
+                                          &stdin_write,
+                                          NULL,
+                                          &cap_fd);
+
+    check_condition("spawn --mnemonic-fd lock test child", child > 0);
+    if (child <= 0) {
+        return;
+    }
+
+    fd = connect_socket_retry("nsigner_test_mi_lock", 5000);
+    check_condition("--mnemonic-fd lock test initial running server", fd >= 0);
+    if (fd >= 0) {
+        close(fd);
+    }
+
+    (void)write_full(stdin_write, "l\n" VALID_MNEMONIC "\n", strlen("l\n" VALID_MNEMONIC "\n"));
+    sleep_ms(800);
+
+    fd = connect_socket_retry("nsigner_test_mi_lock", 2000);
+    check_condition("lock+reunlock via TUI keeps server alive", fd >= 0);
+    if (fd >= 0) {
+        close(fd);
+    }
+
+    if (stdin_write >= 0) {
+        close(stdin_write);
+    }
+
+    (void)kill(child, SIGTERM);
+    (void)waitpid(child, &status, 0);
+    if (cap_fd >= 0) {
+        close(cap_fd);
+    }
+}
+
+int main(void) {
+    (void)signal(SIGPIPE, SIG_IGN);
+
+    test_stdin_happy_path();
+    test_stdin_eof_without_newline();
+    test_stdin_invalid_mnemonic();
+    test_stdin_overflow();
+    test_fd_happy_path();
+    test_mutual_exclusion_and_validation_errors();
+    test_lock_reunlock_falls_back_to_tui_after_fd_startup();
+
+    if (g_failures == 0) {
+        printf("ALL TESTS PASSED\n");
+        return 0;
+    }
+
+    printf("TESTS FAILED: %d\n", g_failures);
+    return 1;
+}

tests/test_policy.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -390,7 +390,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */
@@ -527,6 +527,14 @@ int main(void) {
     check_condition("parse_preapprove_spec maps nonzero nostr_index role", strcmp(parsed.roles[0], "nostr_idx_2") == 0);
     check_condition("parse_preapprove_spec stores nonzero nostr_index", parsed_nostr_index == 2);
 
+    rc = parse_preapprove_spec("caller=qubes:personal+pubkey:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef,role=main",
+                               &parsed,
+                               &parsed_nostr_index);
+    check_condition("parse_preapprove_spec accepts composite qubes+pubkey caller", rc == 0);
+    check_condition("parse_preapprove_spec stores composite caller",
+                    strcmp(parsed.caller,
+                           "qubes:personal+pubkey:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef") == 0);
+
     rc = parse_preapprove_spec("role=main", &parsed, &parsed_nostr_index);
     check_condition("parse_preapprove_spec rejects missing caller", rc == -1);
     rc = parse_preapprove_spec("caller=uid:1000", &parsed, &parsed_nostr_index);

tests/test_qrexec_auth.c

@@ -0,0 +1,369 @@
+#define _GNU_SOURCE
+
+#include <arpa/inet.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <cJSON.h>
+#include <nostr_core/nostr_common.h>
+
+#include "../src/auth_envelope.h"
+
+#define MAX_MSG_SIZE 65536
+
+static int g_failures = 0;
+
+static void check_condition(const char *name, int condition) {
+    if (condition) {
+        printf("PASS: %s\n", name);
+    } else {
+        printf("FAIL: %s\n", name);
+        g_failures++;
+    }
+}
+
+static int write_full(int fd, const void *buf, size_t len) {
+    const unsigned char *p = (const unsigned char *)buf;
+    size_t off = 0;
+
+    while (off < len) {
+        ssize_t n = write(fd, p + off, len - off);
+        if (n < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            return -1;
+        }
+        off += (size_t)n;
+    }
+
+    return 0;
+}
+
+static int send_framed(int fd, const char *payload) {
+    uint32_t len = (uint32_t)strlen(payload);
+    uint32_t be_len = htonl(len);
+
+    if (write_full(fd, &be_len, sizeof(be_len)) != 0) {
+        return -1;
+    }
+    if (write_full(fd, payload, len) != 0) {
+        return -1;
+    }
+    return 0;
+}
+
+static int recv_framed(int fd, char **out_payload) {
+    unsigned char *buf = NULL;
+    size_t used = 0;
+    size_t cap = 0;
+
+    if (out_payload == NULL) {
+        return -1;
+    }
+    *out_payload = NULL;
+
+    for (;;) {
+        unsigned char chunk[1024];
+        ssize_t n = read(fd, chunk, sizeof(chunk));
+        if (n == 0) {
+            break;
+        }
+        if (n < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            free(buf);
+            return -1;
+        }
+
+        if (used + (size_t)n > cap) {
+            size_t new_cap = (cap == 0) ? 2048 : cap * 2;
+            while (new_cap < used + (size_t)n) {
+                new_cap *= 2;
+            }
+            {
+                unsigned char *tmp = (unsigned char *)realloc(buf, new_cap);
+                if (tmp == NULL) {
+                    free(buf);
+                    return -1;
+                }
+                buf = tmp;
+                cap = new_cap;
+            }
+        }
+
+        memcpy(buf + used, chunk, (size_t)n);
+        used += (size_t)n;
+    }
+
+    if (used < 4) {
+        free(buf);
+        return -1;
+    }
+
+    {
+        size_t off;
+        for (off = 0; off + 4 <= used; ++off) {
+            uint32_t be_len;
+            uint32_t len;
+
+            memcpy(&be_len, buf + off, sizeof(be_len));
+            len = ntohl(be_len);
+            if (len == 0 || len > MAX_MSG_SIZE) {
+                continue;
+            }
+            if (off + 4U + (size_t)len > used) {
+                continue;
+            }
+            if (buf[off + 4] != '{') {
+                continue;
+            }
+
+            {
+                char *payload = (char *)malloc((size_t)len + 1U);
+                if (payload == NULL) {
+                    free(buf);
+                    return -1;
+                }
+                memcpy(payload, buf + off + 4, (size_t)len);
+                payload[len] = '\0';
+                *out_payload = payload;
+                free(buf);
+                return 0;
+            }
+        }
+    }
+
+    free(buf);
+    return -1;
+}
+
+static char *build_auth_request(const unsigned char privkey[32],
+                                const char *req_id,
+                                const char *method) {
+    cJSON *root = NULL;
+    cJSON *params = NULL;
+    cJSON *auth = NULL;
+    char *printed = NULL;
+
+    params = cJSON_CreateArray();
+    if (params == NULL) {
+        return NULL;
+    }
+    cJSON_AddItemToArray(params, cJSON_CreateString(""));
+
+    if (auth_envelope_build_for_request(req_id,
+                                        method,
+                                        params,
+                                        privkey,
+                                        "qrexec-test",
+                                        time(NULL),
+                                        &auth) != 0) {
+        cJSON_Delete(params);
+        return NULL;
+    }
+
+    root = cJSON_CreateObject();
+    if (root == NULL) {
+        cJSON_Delete(params);
+        cJSON_Delete(auth);
+        return NULL;
+    }
+
+    cJSON_AddStringToObject(root, "id", req_id);
+    cJSON_AddStringToObject(root, "method", method);
+    cJSON_AddItemToObject(root, "params", params);
+    cJSON_AddItemToObject(root, "auth", auth);
+
+    printed = cJSON_PrintUnformatted(root);
+    cJSON_Delete(root);
+    return printed;
+}
+
+static int run_qrexec_once(const char *request_json, char **out_response) {
+    int in_pipe[2];
+    int out_pipe[2];
+    pid_t child;
+    int status;
+    const char *mnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about\n";
+
+    if (out_response == NULL || request_json == NULL) {
+        return -1;
+    }
+    *out_response = NULL;
+
+    if (pipe(in_pipe) != 0) {
+        return -1;
+    }
+    if (pipe(out_pipe) != 0) {
+        close(in_pipe[0]);
+        close(in_pipe[1]);
+        return -1;
+    }
+
+    child = fork();
+    if (child < 0) {
+        close(in_pipe[0]);
+        close(in_pipe[1]);
+        close(out_pipe[0]);
+        close(out_pipe[1]);
+        return -1;
+    }
+
+    if (child == 0) {
+        int null_fd = open("/dev/null", O_WRONLY);
+        dup2(in_pipe[0], STDIN_FILENO);
+        dup2(out_pipe[1], STDOUT_FILENO);
+        if (null_fd >= 0) {
+            dup2(null_fd, STDERR_FILENO);
+            close(null_fd);
+        }
+
+        close(in_pipe[0]);
+        close(in_pipe[1]);
+        close(out_pipe[0]);
+        close(out_pipe[1]);
+
+        (void)setenv("QREXEC_REMOTE_DOMAIN", "personal", 1);
+
+        execl("./build/nsigner",
+              "./build/nsigner",
+              "--listen", "qrexec",
+              "--auth", "optional",
+              "--preapprove", "caller=qubes:personal,role=main",
+              (char *)NULL);
+        _exit(127);
+    }
+
+    close(in_pipe[0]);
+    close(out_pipe[1]);
+
+    if (write_full(in_pipe[1], mnemonic, strlen(mnemonic)) != 0) {
+        close(in_pipe[1]);
+        close(out_pipe[0]);
+        (void)kill(child, SIGKILL);
+        (void)waitpid(child, &status, 0);
+        return -1;
+    }
+
+    /* Give prompt_load_mnemonic()/fgets() time to consume only the mnemonic line
+     * before we write framed request bytes to the same stdin stream. */
+    {
+        struct timespec ts;
+        ts.tv_sec = 0;
+        ts.tv_nsec = 250 * 1000 * 1000;
+        (void)nanosleep(&ts, NULL);
+    }
+
+    if (send_framed(in_pipe[1], request_json) != 0) {
+        close(in_pipe[1]);
+        close(out_pipe[0]);
+        (void)kill(child, SIGKILL);
+        (void)waitpid(child, &status, 0);
+        return -1;
+    }
+    close(in_pipe[1]);
+
+    if (recv_framed(out_pipe[0], out_response) != 0) {
+        close(out_pipe[0]);
+        (void)kill(child, SIGKILL);
+        (void)waitpid(child, &status, 0);
+        return -1;
+    }
+
+    close(out_pipe[0]);
+    if (waitpid(child, &status, 0) <= 0) {
+        free(*out_response);
+        *out_response = NULL;
+        return -1;
+    }
+
+    return 0;
+}
+
+int main(void) {
+    char *resp = NULL;
+    char *auth_req = NULL;
+    unsigned char privkey[32] = {
+        0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
+    };
+
+    check_condition("nostr_init for auth signing", nostr_init() == 0);
+
+    /* no auth => legacy qubes:personal preapprove should match */
+    if (run_qrexec_once("{\"id\":\"1\",\"method\":\"get_public_key\",\"params\":[\"\"]}", &resp) == 0) {
+        check_condition("qrexec optional/no-auth still allows legacy qubes caller preapprove",
+                        strstr(resp, "\"result\":") != NULL);
+        free(resp);
+        resp = NULL;
+    } else {
+        check_condition("qrexec optional/no-auth request roundtrip", 0);
+    }
+
+    auth_req = build_auth_request(privkey, "2", "get_public_key");
+    check_condition("build qrexec auth request", auth_req != NULL);
+    if (auth_req != NULL) {
+        if (run_qrexec_once(auth_req, &resp) == 0) {
+            check_condition("qrexec optional/auth request uses composite identity and misses legacy preapprove",
+                            strstr(resp, "\"code\":2001") != NULL && strstr(resp, "policy_denied") != NULL);
+            free(resp);
+            resp = NULL;
+        } else {
+            check_condition("qrexec optional/auth request roundtrip", 0);
+        }
+        free(auth_req);
+        auth_req = NULL;
+    }
+
+    auth_req = build_auth_request(privkey, "3", "get_public_key");
+    check_condition("build second qrexec auth request", auth_req != NULL);
+    if (auth_req != NULL) {
+        cJSON *root = cJSON_Parse(auth_req);
+        char *tampered = NULL;
+        cJSON *method_item;
+
+        if (root != NULL) {
+            method_item = cJSON_GetObjectItemCaseSensitive(root, "method");
+            if (cJSON_IsString(method_item)) {
+                cJSON_SetValuestring(method_item, "sign_event");
+            }
+            tampered = cJSON_PrintUnformatted(root);
+            cJSON_Delete(root);
+        }
+
+        if (tampered != NULL && run_qrexec_once(tampered, &resp) == 0) {
+            check_condition("qrexec optional/malformed-auth rejects with auth-layer code",
+                            strstr(resp, "\"code\":2015") != NULL && strstr(resp, "auth_envelope_mismatch") != NULL);
+            free(resp);
+            resp = NULL;
+        } else {
+            check_condition("qrexec optional/malformed-auth request roundtrip", 0);
+        }
+
+        free(tampered);
+        free(auth_req);
+    }
+
+    nostr_cleanup();
+
+    if (g_failures == 0) {
+        printf("ALL TESTS PASSED\n");
+        return 0;
+    }
+
+    printf("TESTS FAILED: %d\n", g_failures);
+    return 1;
+}

tests/test_role_table.c

@@ -232,7 +232,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -387,7 +387,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

tests/test_selector.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -384,7 +384,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */

tests/test_socket_name.c

@@ -229,7 +229,7 @@ const char *enforce_strerror(int err);
 #define POLICY_MAX_ROLES      16
 #define POLICY_MAX_PURPOSES   8
 #define POLICY_VERB_MAX_LEN   32
-#define POLICY_CALLER_MAX_LEN 64
+#define POLICY_CALLER_MAX_LEN 160
 
 /* Prompt behavior */
 typedef enum {
@@ -384,7 +384,7 @@ typedef struct {
     uid_t uid;
     gid_t gid;
     pid_t pid;
-    char caller_id[64];  /* "uid:<n>" */
+    char caller_id[POLICY_CALLER_MAX_LEN];  /* "uid:<n>" */
 } caller_identity_t;
 
 /* Server context */