bind asset inputs to CLSAG ownership proofs

2 files changed, 15 insertions, 6 deletions

diff --git a/docs/MONZERO_ASSETS_V1_SPEC.md b/docs/MONZERO_ASSETS_V1_SPEC.md
index 55d1391ef..0d1f928e9 100644
--- a/docs/MONZERO_ASSETS_V1_SPEC.md
+++ b/docs/MONZERO_ASSETS_V1_SPEC.md
@@ -268,12 +268,20 @@ issuance commitments that disagree with the declared supply. Malformed curve
 proofs are converted to deterministic validation failure rather than escaping
 as exceptions.
 
-This layer still does **not** authorize ownership or prevent double spends.
-Production integration requires ring-member references resolved against stored
-asset outputs, asset key images, a domain-separated CLSAG transcript, canonical
-wire serialization, and database indexes for unspent output lookup. Until that
-layer exists and is reviewed, these proofs cannot make an asset transaction
-valid on any Monzero network.
+The next inactive layer adds domain-separated CLSAG ownership proofs. A proof
+commits to the network UUID, carrier transaction, asset ID, pseudo input, and
+all ring output IDs, destination keys, and amount commitments. Rings contain
+exactly 16 members. Verification rejects network/carrier replay, cross-asset
+members, duplicate or zero output IDs, malformed points, key-image tampering,
+and any pseudo input without exactly one matching proof. Key images must also
+be unique inside one transaction.
+
+This still does **not** provide global double-spend prevention: production
+integration must resolve every claimed ring member against the authoritative
+asset-output database and reject key images already spent by earlier blocks or
+the mempool. Canonical wire serialization and reorg-safe output/key-image
+indexes are also outstanding. Until those layers exist and are reviewed, these
+proofs cannot make an asset transaction valid on any Monzero network.
 
 ## 7. Metadata
 
diff --git a/docs/MONZERO_PHASE0_STABILIZATION.md b/docs/MONZERO_PHASE0_STABILIZATION.md
index 4b9a37e72..4eef6e1dd 100644
--- a/docs/MONZERO_PHASE0_STABILIZATION.md
+++ b/docs/MONZERO_PHASE0_STABILIZATION.md
@@ -135,6 +135,7 @@ isolated disposable development network may be used after cryptographic review.
 - [x] Atomic block-extension validation against independently supplied native carrier commitments.
 - [x] Persistent LMDB issuance registry with restart reconstruction and native reorg rollback.
 - [x] Inactive per-asset Pedersen/Bulletproof+ conservation and burn verifier.
+- [x] Inactive network/carrier/asset-bound CLSAG ownership proof verifier.
 - [x] External cryptographic-review brief and mandatory threat cases.
 - [ ] Reviewed confidential per-asset commitment and range-proof construction.
 - [ ] Versioned asset transaction serialization with strict parser limits.