Spend A only if B is co-spent

The question

Robin Linus's thread How CTV+CSFS improves BitVM bridges needs a connector: an operator's step must consume one specific UTXO. CTV commits to a transaction's outputs, not its inputs, and ajtowns showed that the scriptSig-based workaround is open to substitution.

Can tapscript itself demand that a particular outpoint is spent in the same transaction?

What was built

• Same-signature binding. One Schnorr signature must pass OP_CHECKSIGFROMSTACK over a message the witness supplies and OP_CHECKSIG over the sighash the node computes. One signature cannot stand for two messages, so the witness copy of the sighash preimage has to be the real one.
• Preimage decomposition. The witness supplies the 212-byte preimage in chunks; the script inspects one chunk, then rebuilds the whole with OP_CAT.
• A 196-byte leaf that hardcodes B's outpoint. The witness supplies A's outpoint, and SHA256(A || B) must equal sha_prevouts at preimage bytes 10–41.
• Two confirmed spends of A with B. Swapping in a different coin C is rejected by testmempoolaccept: Script failed an OP_EQUALVERIFY operation.

How it works

witness (bottom -> top): sig(64) post_c(56) post_b(57) post_a(57) pre(10) sha(32) a_outpoint(36)

<B_outpoint> CAT SHA256 SWAP DUP ROT EQUALVERIFY   # sha == SHA256(a_outpoint || B)
SWAP SIZE 10 EQUALVERIFY                            # pre is 10 bytes -> sha sits at offset 10
SWAP CAT SWAP CAT SWAP CAT SWAP CAT                 # pre||sha||post_a||post_b||post_c
<tag[0:32]> <tag[32:64]> CAT SWAP CAT SHA256        # TapSighash(preimage)
OVER SWAP <pk> CHECKSIGFROMSTACK VERIFY             # sig valid over witness preimage
<pk> CHECKSIG                                       # same sig valid over real sighash

If C replaces B, the real sha_prevouts is SHA256(A || C). Supplying it fails the EQUALVERIFY; supplying SHA256(A || B) makes the witness preimage differ from the real one, so the same signature cannot pass both checks.

On chain

A + C (C substituted for B): rejected by testmempoolaccept, never broadcast.

Check it yourself

The repository re-checks every claim on this page (no keys, no node).

git clone https://github.com/aaron-recompile/sighash-prevout-binding
cd sighash-prevout-binding
python3 verify_onchain.py
30/30 checks passed

What it does not show

• A signet experiment, not a bridge implementation.
• Assumes SIGHASH_DEFAULT, no annex and a script-path spend (the fixed 212-byte preimage layout).
• Same-signature binding needs a participating signer; keyless covenants are out of scope.