The bilateral signed Plantaré's transport layer — the "formulario
bilateral firmado" from plantare-bilateral.md — as a new interface
alongside the other *Transport contracts, on the shared NostrConnection.
- PlantarePledge: the canonical, byte-stable core (debtor/creditor keys,
seed label, return kind, dates) plus the two Schnorr stubs. Any edit
changes the signing hash, so an accept is always over an immutable
payload.
- PlantareCrypto: BIP-340 signing/verification over SHA-256 of the core,
reusing the same primitive Nostr uses for events — a pubkey both
identifies a party and verifies their stub.
- PlantareTransport + NostrPlantareTransport: propose → accept →
counter-sign (and decline), private end-to-end. Rides the existing
NIP-17 gift wrap carrying a tagged JSON payload, so the relay sees only
ciphertext and an ephemeral author. Offline QR/NFC is the same payload
without a relay.
- Message transport skips Plantaré payloads on the shared kind-1059
channel (and vice-versa), so moves never surface as chat.
Tests: pure pledge/crypto + full handshake over a hermetic relay,
including no-leak and no-chat-bleed. commons_core 101/101 green.
vjrj
516f1f50bc