a room-key proposal signs the hash the verifier checks, and the ping's pill shortens a raw id

crates/persona-state/src/lib.rs

@@ -311,6 +311,32 @@ pub fn validate_asset(
 
 #[cfg(test)]
 mod tests {
+    use super::*;
+
+    /// `sign_local` has to be the exact inverse of `verify_sig_in`, and that
+    /// includes WHAT is signed: every family here signs blake3(body), and the
+    /// verifier hashes before it checks. Signing the raw body produces a
+    /// signature that validates nowhere — the board rejected a room-key
+    /// proposal for exactly this on 2026-09-03, and only a second instance
+    /// on the live network surfaced it.
+    #[test]
+    fn sign_local_is_the_inverse_of_verify_and_the_payload_is_hashed() {
+        const D: &str = "soulstream.playlist/v1";
+        let secret = [3u8; 32];
+        let body = b"a proposal body";
+        let payload = blake3::hash(body).as_bytes().to_vec();
+        let sig = sign_local(D, &secret, &payload);
+        assert!(verify_sig_in(D, &public_of(&secret), &payload, &sig));
+        assert!(
+            !verify_sig_in(D, &public_of(&secret), body, &sig),
+            "the raw body must not validate — callers hash first"
+        );
+        assert!(
+            !verify_sig_in("soulstream.friend/v1", &public_of(&secret), &payload, &sig),
+            "a signature must not cross domains"
+        );
+    }
+
     use super::*;
     use ed25519_dalek::{Signer, SigningKey};