[flare-999]

Overview

This PR adds a session nonce registry that issues and validates single-use nonces for signed off-chain actions, preventing replay attacks on admin and governance operations. Nonces are tracked per wallet, invalidated immediately on consumption, and surfaced in ActionExecuted events for auditability.

Related Issue

Changes

🔐 Session Nonce Registry

• [MODIFY] creator-keys/src/protocol_governance.rs

  • Added per-wallet nonce storage with get_nonce(wallet) returning the current nonce.
  • Added consume_nonce(wallet, nonce) that validates the supplied nonce, increments the stored value, and invalidates the consumed nonce immediately.
  • Replay of an already-consumed nonce returns NonceAlreadyUsed.
  • Nonce consumption is serialized per wallet so concurrent attempts cannot both succeed.

• [MODIFY] creator-keys/src/emergency_pause.rs

  • Routed signed admin/pause actions through consume_nonce before execution so replayed signed actions are rejected.
  • Included the consumed nonce in the emitted ActionExecuted event.

• [MODIFY] creator-keys/src/events.rs

  • Extended ActionExecuted to carry the session nonce for auditability.

Verification Results

cargo test -p creator-keys
✅ nonce registry + governance/emergency_pause coverage passing

Acceptance Criteria	Status
get_nonce returns correct current nonce per wallet	✅ Per-wallet nonce lookup implemented
consume_nonce increments correctly after use	✅ Nonce incremented on successful consumption
Replay of consumed nonce returns NonceAlreadyUsed error	✅ Consumed nonces rejected with NonceAlreadyUsed
Nonce included correctly in ActionExecuted events	✅ Event payload extended with nonce
Concurrent nonce consumption handled without race condition	✅ Per-wallet serialization prevents double-consumption

Closes #1036

[Chucks1093]

✅ PR Ready for Review

Due to a recent malware incident affecting our repositories, all PRs are required to pass automated security checks before being reviewed for merging.

This PR has passed all automated checks:

• ✅ Security scan — no malicious code detected
• ✅ No merge conflicts
• ✅ CI checks passed

Next step: Please share this PR link in our Telegram group so a maintainer can review and merge it: https://t.me/c/accesslayerorg/8514