There are two ctypes loaders for the same Falcon signing core:

  sdk/src/trelyan_pq/falcon.py    used by the SDK
  contracts/falcon_det1024.py    used by deploy_testnet.py and
                                 test_inscription.py

Commit eb67e4a (2026-08-10, "close two local library/module load-path
hijack vectors", pre-audit findings TF-01/TF-02) removed the cwd-relative
default. `git show --stat eb67e4a` confirms it touched only two files, both
under sdk/. contracts/falcon_det1024.py has not been modified since the
initial commit a806f63 and still read:

  _LIB_PATH = os.environ.get("FALCON_DET1024_LIB", "./libfalcondet1024.so")

A dlopen path containing a slash resolves against the process working
directory, so that default loads keygen, sign and verify out of whatever
./libfalcondet1024.so happens to be in cwd (CWE-426).

The unfixed copy is the one on the documented deployment path: README.md
tells the operator to run `python contracts/deploy_testnet.py` from the repo
root, and that script imports this module and calls keygen(),
sign_compressed() and verify_compressed() to mint a real inscription. So an
explicit pre-audit security fix was applied everywhere except the path that
signs. Two aggravating details: .gitignore excludes *.so/*.dylib/*.dll, so a
planted library never appears in `git status`; and until yesterday the CI
path filter excluded contracts/ entirely, so nothing here was ever executed.

Fix: default to "" and fail closed with the same message the SDK uses.

sdk/tests/test_loader_parity.py plants a decoy libfalcondet1024.{so,dylib,dll}
in a temp directory, runs each loader from there in a subprocess with
FALCON_DET1024_LIB unset, and requires refusal BEFORE the decoy is touched -
asserting the error names the missing variable and does NOT name the decoy.
Checking the constant alone would only prove a literal changed. A second test
guards the constant too, so a re-introduced relative default is obvious in
review.

Note the SDK case needs m.keygen(), not m.default_signer(): the loader is
lazy, so constructing the signer loads nothing and the test would pass
vacuously. Verified by mutation - restoring the old default turns both the
behavioural and the source test red; the fix turns them green.

The test lives in sdk/tests/ because that is what CI runs; contracts/ has no
test job, and a parity test parked where nothing executes it is the same
defect it exists to prevent.

Found by an adversarial claim-vs-enforcement sweep (TCE-03).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

# Conflicts:
#	examples/falcon.ts
#	src/falcon-signer.ts
#	src/logicsig.ts
#	src/pq-signer.ts
#	src/signer.ts
#	src/signing.ts
#	tests/12.PQ.ts
#	tests/cucumber/steps/steps.js

BREAKING CHANGE: legacy passkey flagging no longer runs automatically on engine
start. It is now revision 0001 of the package's migration manifest and requires
WithMigrations from @algorandfoundation/provider-migrations to be installed on
the provider. Applications that do not add it will never flag legacy passkeys.