the cheapest place to catch an attack is the document

The design document for the identity layer was audited more times than the code that came out of it. Each round was independent, each produced findings sorted into severity bands, and each finding had to be resolved in place: a new subsection, a corrected cross-reference, or an explicit statement that a limitation exists and is accepted.

Two classes of finding recurred, and both were cheap only because no code existed yet. The first was single-use material. Key material derived for one message must be destroyed immediately after that use, because a cached copy turns a captured message into something that can be replayed against a later state. That is one sentence in a design document, and its absence was a real weakness.

The second was length ambiguity. Every input to the key-derivation step happened to be fixed length, which made plain concatenation safe. Nobody had written that down, so the property was one future edit away from silently disappearing — the moment a variable-length field was added, two different inputs would derive the same secret. The document now requires length prefixes, and says why.

The rounds also caught contradictions the authors could not see: a count of message types that disagreed with the enumeration above it, one identity derivation described two ways in two sections, a security check present on one protocol path and missing on its parallel sibling.

The cost is that for a stretch the document grew faster than the product, and each round meant re-reading all of it, including the parts everyone had already accepted.

What it proves: this team knows an attack found in prose costs an edit, and it funds that review before a deadline makes the same edit expensive.