Scope. The proof verifies φDSA-algfs, a transcript variant of φDSA: the production signature derives its challenge with SHAKE-256, which cannot be arithmetized, so the in-circuit variant derives it with the suite's field-native algebraic sponge (specified under Security model; experimental, review in progress). The relation and the norm bound are proof-carried; the challenge and the signature's NTT consistency are recomputed by the verifier from public data, which is sound because that data is public. The signature is public, not hidden: the hidden authorization that ships today is the hash-leg one-time-signature proof (Kind 9) beside it. Proofs are generated natively; verification runs live here in a thread-free module.

Independence, precisely. The assumptions are independent; the implementation is not. φSign is entirely φHash. φCipher's KDF ends in one φHash call. φKEM is instantiated with φHash as its XOF (the core is hash-agnostic; a NIST-validated SHAKE-256 instantiation works identically), so its key path also needs φHash to behave as a random oracle. φDSA uses SHAKE-256 throughout and has zero φHash dependency. Read plainly: φHash is a shared component with suite-wide blast radius, not a firewall between the two legs.

The φHash-XOF finding and the fix. φHash fully mixes exactly 196 output bytes; beyond that, output is extended by a linear map only, so every further byte is an affine function of internal state. That is worse than biased: it is potentially state-recovering. The fix is structural. Cryptographic output is hard-capped at 123 bytes (the largest tier that never reaches the extension path), enforced inside the hash itself so no caller, including third-party ones, can cross it; a statistical battery (frozen-position, frequency, runs, per-byte χ², avalanche) now gates every release. An audit confirmed no key-bearing path ever crossed the boundary. The one caller past it, proof-of-work grinding, is public and keyless, and its consensus score now reads only the fully-mixed prefix.

Reading the hash rows. The figures are (second-)preimage strength: classical n, quantum n/2 under Grover, from the actual digest width. The birthday bound does not apply to φSign, by construction: every hash call is tweaked by its position, so an attacker faces target-collision resistance (cost n, not n/2), the same reason WOTS/XMSS/SPHINCS+ tweak their hashes; and the counter ensures no one-time key is reused, with FORS underneath as the few-time net if state ever desyncs. Operative numbers: tier 0 is 232 classical / 116 quantum, tier 2 is 608 / 304. NIST categories are defined by full gate cost, so these are exponent comparisons, not certified category claims.

φKEM (φ-KEM-304). Module-LWE with n=512, k=3, q=3329, η=3, and RM(1,3) reconciliation. The geometry is forced, not chosen: RM(1,3) carries 0.5 bits per coefficient, so a 256-bit secret needs 512 coefficients and the message polynomial fixes n=512; the stated price is an incomplete NTT (128 degree-4 residues, one split shallower than Kyber's). The reconciliation is load-bearing for CCA2 soundness: decode failure computes to δ ≈ 2⁻²⁸⁵ against the FO bound of 2⁻¹²⁸, where the no-code baseline fails outright at 2⁻⁶⁹ (an exact convolution under an average-case noise model; the worst-case question is open and stated in the spec). Core-SVP estimates β ≈ 1462: about 427-bit classical and 387-bit quantum, best read as model lower bounds because β approaches the full dimension. The parameters are deliberately conservative: 157 bits of failure margin at 2× the public key and 2.6× the ciphertext of ML-KEM-1024, a tradeoff the spec owns rather than optimizes away.

φDSA. The ML-DSA algorithm on the shared field (N=256, Q=1342832641, k=l=9, η=7, τ=60), SHAKE-256 throughout: φDSA is the one primitive here with zero φHash dependency. The estimator computes both attacks: MLWE key recovery at 282.4 classical / 256.3 quantum, and SIS strong-unforgeability at 280.6 / 254.7, each above ML-DSA-87 under the same model. η=7 is the smallest noise that lifts key recovery above the SIS ceiling, so forgery binds by design, and the forgery bound sits in the norm-below-q regime where the conservative SIS estimate is provable. The estimator is anchored: it must reproduce the published ML-DSA-2/5 figures (123 / 252) before it is trusted here. Larger keys and signatures (4,352 / 6,206 B) are the deliberate cost of the shared field. Not FIPS-204 byte-conformant; validated against its own KATs.

Verify-in-proof, and the algebraic sponge. The shared field lets signature verification run inside recursive proofs (the first tab, live). SHAKE cannot be arithmetized, so the in-circuit challenge uses the suite's field-native sponge: a Poseidon-class x⁷ design of width 27 (rate 18, capacity 9 field elements), a 27×27 Cauchy MDS layer, and 52 full rounds. Every parameter is derived from a 128-bit collision target, and the build fails if a derivation regresses: a sponge's generic collision resistance is half its capacity, so capacity and digest each carry ⌈256/⌊log₂q⌋⌉ = 9 elements (≈270 bits, digests 36 bytes); the round count covers algebraic-degree attacks (⌈128/log₂7⌉ ≈ 46 plus margin); the challenge seed is 5 squeezed elements (≈150-bit challenge space). It is the least battle-tested element on this page: experimental, in a family with an active cryptanalytic record, under external review that has not yet reported.

The WOTS width, measured and revised. The chain width stood at 13 while the digit extractor produces 3-bit digits; the sweep measured w=8 as identical in security and signature size with 38% fewer hash calls, so the parameter moved to w=8 and every number on this page reflects it. The refuted configuration stays published: measurements move parameters here, and refutations stay on the record.

Mobile. Five React Native packages bridge these into the mobile wallet over JSI: react-native-phi-crypt (φCrypt itself), react-native-phi-sqlite (phi-sqlvfs), react-native-phi-tcp (the TLS-over-TCP fallback), react-native-phi-rpc-client (phi-rpc-cpp), and react-native-phi-zk (the ZK statement library). None are published to npm yet — install from the monorepo directly.