prefixing every signed or hashed message with a context string that says what protocol and version this artifact belongs to, so a signature minted for one purpose can never be replayed as valid for another.
The same 32 bytes with and without a tag - intent, pinned or absent.
Etymology and backstory
the trick is as old as practical protocol design and got formalized as hash-function hygiene in the random-oracle tradition - if two uses of one hash could ever see the same input, prefix them apart. Cross-protocol replay is the attack: a signature over ambiguous bytes gets reinterpreted in a second protocol where those bytes mean something else. TLS 1.3 signs context-labeled transcripts for exactly this reason, and RFC 8032 defines Ed25519ctx and Ed25519ph variants with explicit context strings.
Ecosystem
TLS 1.3 labels, BLS ciphersuite tags, Bitcoin's tagged hashes (BIP 340 uses tagged SHA-256 everywhere), every well-designed signing protocol since the 2010s.
In codexproof
SIG_DOMAIN in sign.rs (lines 13 to 20) - the signed message is "prov-sig:v1" plus a newline plus the cid. The v1 pins the version so a future format change cannot collide with old signatures; the prefix pins the protocol so a codexproof signature can never be smuggled into another system that happens to sign 32-byte values.
---