feat: wallet owner_id on the wire (B1.4 + B1.5)

[frahlg]

Implements docs/superpowers/specs/2026-06-12-b1.4-wallet-owner-id-wiring.md
(decisions locked 2026-06-13) and the plan in
docs/superpowers/plans/2026-06-13-b1.4-b1.5-wallet-wire-plan.md.

Summary

owner_id is now the base58 Solana wallet address end-to-end. The agent
recovers the X25519 Noise-KK pin from a wallet-signed binding carried on the
offer, and pairing pins the wallet — proven by an auth signature over the Noise
channel binding. No legacy path (decision 2): wallet + binding are always
required; an identity without a wallet re-pairs via mir keygen --wallet.

The Noise data plane is byte-identical — the X25519 transport and the
wallet-derivation / wallet-binding / Noise-KK vectors are untouched. Only the
source of the pinned key changed, plus a new pairing auth scheme.

What changed (per slice)

• B1.4.0 signal — opaque Binding field on SignalMsg; the relay forwards it
  verbatim and never reads it (still blind). Backward-compatible, independently
  deployable.
• B1.4.1 agent — at attach, parse+verify the offer's binding
  (wallet == owner_id + signature), pin binding.x25519. Replaces hex.Decode(owner_id).
• B1.4.2 client — owner.json gains a stable device_id and a cached signed
  binding (signed at SetFromSecret/Rekey); mir attach dials owner_id=<wallet>
  and carries the binding on the offer. KK initiator still uses the X25519 key.
• B1.4.3 pairing — msg1 carries PairClaim{wallet}; a new msg3 carries
  Ed25519.sign(wallet, "miranda/auth/v1" || channelBinding). The agent pins the
  base58 wallet only if it verifies. Adds identity.SignAuth/VerifyAuth.
• B1.5 web — sign-in derives the wallet alongside the X25519 key (one prf root);
  attach sends owner_id=<wallet> + a signed binding; pairing mirrors PairClaim +
  msg3 auth byte-for-byte with Go.

device semantics (clarified vs the draft spec)

binding.device is the owner's stable device id, not the agent's machine_id, so
one cached binding works across all the owner's machines (decision 3). The agent checks
wallet == owner_id + signature, not device == machine_id — KK already
authenticates the X25519 holder, so the device check would only break caching.

Tests

• Go: go test ./... green (incl. agent/client/pairing e2e updated to wallet+binding);
  go build ./..., gofmt, go vet clean.
• Web: npm test 93/93 (new auth.test.js; rewritten pairing-interop asserts
  msg1/msg2/msg3 byte-match Go via the new wallet_prf in the vector).
• Byte gate: only testdata/pair-interop.json changed; wallet-derivation /
  wallet-binding / Noise-KK vectors untouched.

Deploy sequencing (your hand)

The new mir-signal (one-line Binding passthrough) is backward-compatible, so it
can be redeployed first. Because there is no legacy path, agents + clients are a
coordinated cut with the wallet wire; existing X25519-only identities re-pair via
mir keygen --wallet.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.