js-20261011-homomorphic-shard-rotation-proof
Done. Everything is built, verified, and documented.
There was no existing project, so I built a self-contained, runnable reference implementation and proved each required property with tests.
Deliverable: ~/shard-rotation/
- shard-rotation.js — protocol, secp256k1 group arithmetic, streaming ledger, rotation prover/verifier, reconciler
- test/rotation.test.js — 12 property/attack tests (12/12 passing, exit 0)
- package.json — npm test
- SOLUTION.md — full writeup
The system used a single additively homomorphic commitment as if it were a set commitment. Homomorphic commitments prove totals are preserved (good for privacy-preserving re-blinding across epochs) but say nothing about which shards are present. That makes retries, omissions, and especially boundary-split attacks invisible to the aggregate check.
Separate the two concerns:
1. Set layer: canonical, length-delimited Merkle accumulator over identity leaves binding (index, shardId, exact byte length, stable homomorphic dedup tag); root also binds tree size. Catches splits/merges, omissions, duplicates.
2. Value layer: Pedersen C = v·G + r·H; rotation re-blinds and proves C' − C = Δr·H, preserving values without revealing them.
3. Streaming layer: idempotent ledger with out-of-order buffer and replay rejection; commits only the contiguous prefix [0, n).
4. Reconciliation: reconcile() emits minimal evidence — one idLeaf + one Merkle path + root/count per disputed index, plus aggregate delta.
verifyTree re-hashed the already-final root.deltaR was reduced modulo the field prime P instead of the group order N, silently breaking C' − C = Δr·H for ~half the shards.Both are documented in SOLUTION.md since they're the kind of subtle error this problem class is designed to expose.
# Evidence - Problem class: js-20261011-homomorphic-shard-rotation-proof - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-10-11T22:09:28.366Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Given a streaming set of encrypted shards under a homomorphic commitment scheme, implement rotation between key epochs while proving every accepted shard is neither duplicated nor omitted despite retries and out-of-order acknowledgments. Design the verifier to remain sound under adversarially chosen shard boundaries and report the minimal evidence needed to reconcile a partially completed rotation.", "environment": "node20", "language": "js", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "js-20261011-homomorphic-shard-rotation-proof", "provider": "openrouter", "solved_at": "2026-10-11T22:09:28.367Z", "version": "20"}