[intel352]

Summary

Port the additive upstream v0.104.0 account-key and MFA metadata contract to pure Go:

• Private, always-redacted SVRKey with registration lock, recovery, storage-service and logging derivations; preserve DeriveSVRKey() [32]byte.
• Authenticated PIN master-key HMAC-SHA256-SIV encoding/decoding, with zero plaintext on rejection.
• Fixed 160-byte MFA metadata, UTF-8/NUL/98-byte name validation, timestamp truncation/overflow checks, authenticate-before-decrypt and bounded upstream-compatible protobuf decoding.
• Media AES/HMAC split constants, internal generated MFA protobuf, external API compile fixture, property/fuzz/tamper tests, and real Rust vector consumers.
• Immutable upstream oracle pin, fixture digest/provenance updates, locked CI replay and backward-compatible revision-pin support in the weekly updater.

No service/network APIs, raw SVR getter, release tag, or whole-protocol v0.104.0 claim. The global compatibility baseline remains v0.96.4 pending the consolidated refresh.

Scope

Approved workspace umbrella: docs/plans/2026-07-10-signal-spaces-group-channels.md.

PR Count: 34. Tasks: 41. Locked: 2026-10-03T08:47:45Z.

PR Group	Title	Task	Branch
12	Port upstream account and MFA parity	31	libsignal-v01040-account-keys

This PR completes only Task 31. Encrypted Spaces proof work is explicitly deferred by ADR 0150; no proof optimization resumes. Protocol/SPQR work and the consolidated release remain separate PR boundaries.

Upstream Evidence

• Release: signalapp/libsignal v0.104.0.
• Annotated tag object: 03b9987415e6dcb3d83dfde6a16b52d2b59a7b44.
• Peeled commit: 257105c55a7389ca6b1e85185e2769465e6729f1.
• SPQR 1.6.0: 06959b4708f9b7b1e94d0f8cc835f3958c077e94; libcrux-ml-kem exactly 0.0.10.
• Genuine Cargo/rustc 1.98.1 build and replay, with compiler explicitly selected because local Homebrew precedes rustup proxies. Rust fixture replay: 2 tests passed; legacy values retained.
• Local Rust debug-info stripping emits a nonfatal rust-objcopy/missing libLLVM.dylib warning; compilation, tests, vector replay, and CLI interop still exit 0. No system toolchain configuration was modified.

Verification

• Go 1.26.4: full tests and race suite, CGO_ENABLED=0 go build ./..., go vet ./..., lint: 0 issues.
• Live Go/Rust interop passes against the genuinely Rust-1.98.1-built harness.
• Four fuzz targets pass: PIN SIV, MFA round trip, ciphertext rejection, and authenticated arbitrary plaintext.
• Actual updater same-release no-op passes; hermetic tests cover legacy/revision pins and annotated-tag movement of all three dependencies. External Cargo/GitHub dependencies are substituted only in those updater tests.
• Independent upstream decrypt probe: 30 MFA assertions confirm malformed-input bounds and unknown-group behavior.
• Bounded review: two concrete Important findings fixed; closing verdict SHIP-IT, no Critical/Important findings.
• Linux/macOS Go and Linux oracle CI must pass before merge.

Regression Proof

With authentication/redaction deliberately bypassed:
TestMFAMetadataRoundTripAndTampering: FAIL, tampered MAC byte 128 returned metadata.
TestPinHashMasterKeySIV: FAIL, tampered byte 0 returned plaintext.
TestSVRDerivationsAndRedaction: FAIL, formatting/logging leaked the public test canary.

With protections restored: all three PASS. Authenticated overlong protobuf tag/length tests also fail before the bounds fix and pass after it.

Runtime Launch Transcript

Build: CGO_ENABLED=0 go build ./... exits 0.
Launch: a tiny downstream consumer imports the actual accountkeys package and uses crypto/rand.Reader; no library stubs.

svr=[REDACTED SVRKey] pin_round_trip=true mfa_bytes=160 mfa_round_trip=true wrong_key_rejected=true

Failure-signature scrape: clean. Verdict: PASS.
Doc-reconciliation: clean; current oracle pin and inherited compatibility baseline are explicitly distinguished.