Label passthrough is struct-faithful, not byte-faithful — re-encoding can break signatures

[scarnecchia]

Problem

The store/slurper contract claims labels relay "byte-faithful (unmodified)". The actual path decodes upstream labels into indigo's LabelDefs_Label and re-marshals via cbor-gen (internal/store/frame.go:15). That is struct-faithful, not byte-faithful.

If an upstream label carries fields the indigo type doesn't model (lexicon evolution, future ver bumps), they are silently dropped and the re-encoded bytes diverge from what was signed — breaking downstream signature verification, the one property this relay must preserve.

internal/verify and the E2E provenance checks mitigate this today, but the protection holds only while the Go type stays in sync with the wire format.

Options

• Carry raw upstream label bytes through ingest and re-emit them verbatim inside the output frame.
• At minimum, for require_sig labelers, re-verify the signature against the re-encoded bytes at ingest and drop (with a metric) on mismatch, so divergence is detected at the source instead of by downstream consumers.

Acceptance

• A label containing an unknown field either round-trips byte-identically or is rejected at ingest with observability — it is never silently relayed with a broken signature.