fix: thread agent nonce through tx codec and ABCI verification

The SDK's X-Nonce header was verified at the REST middleware layer but
dropped before reaching CometBFT ABCI consensus. The nonce was missing
from AgentAuthProof, ParsedTx, the wire codec, and VerifyAgentProof,
causing ABCI FinalizeBlock to reconstruct bodyHash+timestamp (without
nonce) while the signature covered bodyHash+timestamp+nonce — resulting
in "agent signature verification failed" (code 11) on every submit.

Threads AgentNonce through the full chain: middleware → embedAgentAuth →
tx codec (length-prefixed, backward compatible) → VerifyAgentProof.
Legacy transactions without nonce continue to verify correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: l33tdawg

api/rest/middleware/auth.go

@@ -66,6 +66,7 @@ type AgentAuthProof struct {
 	Signature []byte // Ed25519 signature (64 bytes)
 	Timestamp int64  // Unix seconds used in signing
 	BodyHash  []byte // SHA-256 of request body (32 bytes)
+	Nonce     []byte // Optional nonce used in signing (nil if legacy)
 }
 
 // skipAuthPaths lists paths that bypass authentication.
@@ -204,6 +205,7 @@ func Ed25519AuthMiddleware(next http.Handler) http.Handler {
 			Signature: sig,
 			Timestamp: tsUnix,
 			BodyHash:  bodyHash[:],
+			Nonce:     nonce,
 		}
 		ctx := context.WithValue(r.Context(), agentIDKey, agentID)
 		ctx = context.WithValue(ctx, agentAuthKey, proof)

api/rest/server.go

@@ -276,6 +276,7 @@ func embedAgentAuth(ctx context.Context, ptx *tx.ParsedTx) {
 	ptx.AgentSig = proof.Signature
 	ptx.AgentTimestamp = proof.Timestamp
 	ptx.AgentBodyHash = proof.BodyHash
+	ptx.AgentNonce = proof.Nonce
 }
 
 // Router returns the underlying chi router for testing.

internal/abci/app.go

@@ -1113,7 +1113,7 @@ func verifyAgentIdentity(parsedTx *tx.ParsedTx) (string, error) {
 	if len(parsedTx.AgentPubKey) == 0 || len(parsedTx.AgentSig) == 0 || len(parsedTx.AgentBodyHash) == 0 {
 		return "", fmt.Errorf("no agent identity proof in transaction")
 	}
-	return auth.VerifyAgentProof(parsedTx.AgentPubKey, parsedTx.AgentSig, parsedTx.AgentBodyHash, parsedTx.AgentTimestamp)
+	return auth.VerifyAgentProof(parsedTx.AgentPubKey, parsedTx.AgentSig, parsedTx.AgentBodyHash, parsedTx.AgentTimestamp, parsedTx.AgentNonce)
 }
 
 func (app *SageApp) processOrgRegister(parsedTx *tx.ParsedTx, height int64, blockTime time.Time) *abcitypes.ExecTxResult {

internal/auth/ed25519.go

@@ -100,7 +100,7 @@ func buildRequestMessage(method, path string, body []byte, timestamp int64, nonc
 //
 // This is the critical on-chain identity verification — the ABCI handler uses
 // this to independently establish agent identity without trusting the REST layer.
-func VerifyAgentProof(agentPubKey, agentSig, bodyHash []byte, agentTimestamp int64) (string, error) {
+func VerifyAgentProof(agentPubKey, agentSig, bodyHash []byte, agentTimestamp int64, agentNonce []byte) (string, error) {
 	if len(agentPubKey) != ed25519.PublicKeySize {
 		return "", fmt.Errorf("invalid agent public key length: %d", len(agentPubKey))
 	}
@@ -123,12 +123,15 @@ func VerifyAgentProof(agentPubKey, agentSig, bodyHash []byte, agentTimestamp int
 		return "", fmt.Errorf("no agent identity proof in transaction")
 	}
 
-	// Reconstruct the signed message: bodyHash + bigEndian(timestamp)
+	// Reconstruct the signed message: bodyHash + bigEndian(timestamp) [+ nonce]
 	tsBytes := make([]byte, 8)
 	binary.BigEndian.PutUint64(tsBytes, uint64(agentTimestamp)) // #nosec G115 -- timestamp from trusted int64
-	message := make([]byte, 0, 40)
+	message := make([]byte, 0, 40+len(agentNonce))
 	message = append(message, bodyHash...)
 	message = append(message, tsBytes...)
+	if len(agentNonce) > 0 {
+		message = append(message, agentNonce...)
+	}
 
 	// Verify the agent's Ed25519 signature
 	if !ed25519.Verify(ed25519.PublicKey(agentPubKey), message, agentSig) {

internal/tx/codec.go

@@ -50,10 +50,15 @@ func EncodeTx(tx *ParsedTx) ([]byte, error) {
 		agentBodyHash = make([]byte, 32)
 	}
 
+	agentNonce := tx.AgentNonce
+	if agentNonce == nil {
+		agentNonce = []byte{}
+	}
+
 	// type(1) + payloadLen(4) + payload + nodeSig(64) + nodePub(32) + nonce(8) + timestamp(8)
-	// + agentPub(32) + agentSig(64) + agentTs(8) + agentBodyHash(32)
+	// + agentPub(32) + agentSig(64) + agentTs(8) + agentBodyHash(32) + agentNonceLen(4) + agentNonce(var)
 	totalLen := 1 + 4 + len(payload) + ed25519.SignatureSize + ed25519.PublicKeySize + 8 + 8 +
-		ed25519.PublicKeySize + ed25519.SignatureSize + 8 + 32
+		ed25519.PublicKeySize + ed25519.SignatureSize + 8 + 32 + 4 + len(agentNonce)
 	buf := make([]byte, 0, totalLen)
 	buf = append(buf, byte(tx.Type))
 	buf = appendUint32(buf, uint32(len(payload))) // #nosec G115 -- payload length fits in uint32
@@ -67,6 +72,9 @@ func EncodeTx(tx *ParsedTx) ([]byte, error) {
 	buf = append(buf, agentSig...)
 	buf = appendInt64(buf, tx.AgentTimestamp)
 	buf = append(buf, agentBodyHash...)
+	// Agent nonce (variable length, length-prefixed)
+	buf = appendUint32(buf, uint32(len(agentNonce))) // #nosec G115 -- nonce length fits in uint32
+	buf = append(buf, agentNonce...)
 
 	return buf, nil
 }
@@ -132,6 +140,17 @@ func DecodeTx(data []byte) (*ParsedTx, error) {
 
 		tx.AgentBodyHash = make([]byte, 32)
 		copy(tx.AgentBodyHash, data[offset:offset+32])
+		offset += 32
+
+		// Decode agent nonce if present (length-prefixed, variable length)
+		if offset+4 <= len(data) {
+			nonceLen := binary.BigEndian.Uint32(data[offset : offset+4])
+			offset += 4
+			if nonceLen > 0 && offset+int(nonceLen) <= len(data) { // #nosec G115 -- nonceLen validated
+				tx.AgentNonce = make([]byte, nonceLen)
+				copy(tx.AgentNonce, data[offset:offset+int(nonceLen)]) // #nosec G115 -- nonceLen validated
+			}
+		}
 	}
 
 	if err := decodePayload(tx, payload); err != nil {

internal/tx/types.go

@@ -282,11 +282,12 @@ type ParsedTx struct {
 	Timestamp          time.Time
 
 	// Agent identity proof — allows ABCI to verify agent identity on-chain.
-	// The agent signed SHA256(requestBody) + bigEndian(AgentTimestamp) with their key.
+	// The agent signed SHA256(requestBody) + bigEndian(AgentTimestamp) [+ nonce] with their key.
 	// ABCI re-verifies this signature to establish the authenticated agent identity
 	// independently of the REST layer.
 	AgentPubKey   []byte // Agent Ed25519 public key (32 bytes)
 	AgentSig      []byte // Agent Ed25519 signature (64 bytes)
 	AgentTimestamp int64  // Unix seconds timestamp used in signing
 	AgentBodyHash []byte // SHA256 of original request body (32 bytes)
+	AgentNonce    []byte // Optional nonce used in signing (variable length, 0 if legacy)
 }