archetech / archon / 36475910928

87%

main: 87%

Pull #1301

github

fix(keymaster): pair challenge requests and credentials by maximum matching

Holders chose each request's credential independently or first-fit, so
TypeScript presented one credential for repeated requests, which the
verifier now counts once, and both ports could spend a credential on a
broad request that a narrower one needed. Verifiers had the same
order dependence. Both ports now find a maximum one-to-one pairing when
creating and when verifying a response, under one shared request rule.

Python stored held credentials through a set, so their order depended
on the process hash seed; it now keeps acceptance order as TypeScript
does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

66 of 76 branches covered (86.84%)

Branch coverage included in aggregate %.

12 of 14 relevant lines covered (85.71%)

12.57 hits per line