fix: reject gate signer at any depth in gated subtree

Gated leaves may be nested trees, so check the gate identity against the
full recursive signer set (WalletConfig.Signers) instead of only
top-level terminal leaves.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ScreamingHawk

intent_config.go

@@ -204,12 +204,11 @@ func wrapGate(gateLeaf v3.WalletConfigTree, gateableLeaves ...v3.WalletConfigTre
 	if gateWeight.Cmp(maxUint64) > 0 {
 		return nil, fmt.Errorf("invalid gateLeafNode: weight is too large")
 	}
-	// A gated signer leaf sharing the gate's identity satisfies both sides of the outer
+	// The gate's identity anywhere in the gated subtree satisfies both sides of the outer
 	// threshold with one signature, letting the gate authorize alone
-	for _, leaf := range gateableLeaves {
-		if signer, _, err := signerLeaf(leaf); err == nil && signer == gateSigner {
-			return nil, fmt.Errorf("invalid gateLeafNode: gate signer must not appear among gated leaves")
-		}
+	gatedSigners := (&v3.WalletConfig{Tree: v3.WalletConfigTreeNodes(gateableLeaves...)}).Signers()
+	if _, ok := gatedSigners[gateSigner]; ok {
+		return nil, fmt.Errorf("invalid gateLeafNode: gate signer must not appear among gated leaves")
 	}
 	gateableTree := &v3.WalletConfigTreeNestedLeaf{
 		Weight:    1,

intent_config_test.go

@@ -573,6 +573,44 @@ func TestCreateIntentConfigurationGateDuplicateSapientRejected(t *testing.T) {
 		require.ErrorContains(t, err, "gate signer must not appear among gated leaves")
 	})
 
+	t.Run("gate signer inside a nested leaf is rejected", func(t *testing.T) {
+		nested := &v3.WalletConfigTreeNestedLeaf{
+			Weight:    1,
+			Threshold: 1,
+			Tree:      gateLeaf,
+		}
+		_, err := sequence.CreateIntentConfiguration(mainSigner, []*v3.CallsPayload{&payload}, 0,
+			sequence.WithGate(gateLeaf), sequence.WithSapientSigner(nested))
+		require.ErrorContains(t, err, "gate signer must not appear among gated leaves")
+	})
+
+	t.Run("gate signer inside a node branch is rejected", func(t *testing.T) {
+		otherLeaf := &v3.WalletConfigTreeAddressLeaf{
+			Weight:  1,
+			Address: common.HexToAddress("0x3333333333333333333333333333333333333333"),
+		}
+		branch := v3.WalletConfigTreeNodes(otherLeaf, gateLeaf)
+		_, err := sequence.CreateIntentConfiguration(mainSigner, []*v3.CallsPayload{&payload}, 0,
+			sequence.WithGate(gateLeaf), sequence.WithSapientSigner(branch))
+		require.ErrorContains(t, err, "gate signer must not appear among gated leaves")
+	})
+
+	t.Run("nested tree without the gate signer is allowed", func(t *testing.T) {
+		nested := &v3.WalletConfigTreeNestedLeaf{
+			Weight:    1,
+			Threshold: 1,
+			Tree: &v3.WalletConfigTreeSapientSignerLeaf{
+				Weight:     1,
+				Address:    common.HexToAddress("0x4444444444444444444444444444444444444444"),
+				ImageHash_: core.ImageHash{Hash: common.BigToHash(big.NewInt(4))},
+			},
+		}
+		config, err := sequence.CreateIntentConfiguration(mainSigner, []*v3.CallsPayload{&payload}, 0,
+			sequence.WithGate(gateLeaf), sequence.WithSapientSigner(nested))
+		require.NoError(t, err)
+		require.NotNil(t, config)
+	})
+
 	t.Run("payload-matching leaf as gate is rejected", func(t *testing.T) {
 		subdigestGate := &v3.WalletConfigTreeAnyAddressSubdigestLeaf{
 			Digest: common.BigToHash(big.NewInt(3)),