site: the paper card finally joins the redesign

The last fossil paragraph on the page — an ePrint-era compressed table
of contents, version-patched five times, never re-read as prose. Five
undefined terms of art in one 120-word sentence, a semicolon train of
metadata, internal bookkeeping speaking to visitors ('the version is
printed on the title page'), changelog voice ('New in the August 2026
revisions'). Now: title, clean metadata line (pages, version, DOI),
and three sentences that answer the visitor's only question — should I
click: the guarantees-and-non-guarantees discipline at referee depth,
the sn=0 war story, and the claim matrix as the recommended entry
point. New law (rule 13): fact-patches require whole-card re-reads —
fact probes pass on unreadable prose.
This commit is contained in:
mrwulf 2026-08-22 15:18:26 +02:00
parent 57ac2095c0
commit 7cc5982af3

View file

@ -397,21 +397,16 @@ our roadmap.</strong> (The full walk-through is lecture&nbsp;11 of the Jupyter c
<h2>The paper</h2>
<div class="card"><a href="{base}/paper"><strong>Accountable Distribution of Machine-Checked
Correctness Evidence: A Transparency Model and the Lean Transparency Log</strong></a>
(PDF, 25 pages, <strong>v0.15 revised August&nbsp;2026</strong>; the version is printed on the
title page; DOI <a href="https://doi.org/10.5281/zenodo.22057482">10.5281/zenodo.22057482</a>) the trust decomposition (expensive verification produces an
observation; transparency makes the observation accountable; consumer-local policy decides
acceptance), collision-extracting soundness for inclusion and consistency, scheme-level
accountability GAMES with an explicit composition theorem (head authenticity, position
binding, history binding with a fully proved prefix-transport induction, context-scoped
fork evidence all discharged by named reductions), the policy boundary where
operator labels can veto but never grant acceptance, and the measured model/deployment
divergence reported as a result rather than hidden now together with its closure: the
divergence traced to one omitted RFC&nbsp;9162 conjunct (Step&nbsp;7's <code>sn&nbsp;=&nbsp;0</code>),
zero divergences after the one-line restoration, confirmed by a three-way regression.
New in the August 2026 revisions: the deployment evaluated to its current nineteen-leaf, dual-signed state, an
instantiation section for the SLH-DSA (FIPS&nbsp;205) verify path eleven certificates,
five uninterpreted hash oracles, exact cones and a certificate appendix mirroring the
Ed25519 tiers.</div>
(PDF, 25 pages · v0.15, August&nbsp;2026 · DOI
<a href="https://doi.org/10.5281/zenodo.22057482">10.5281/zenodo.22057482</a>).
The full design and its security analysis: what the log guarantees, stated as
precise games with proofs and what it deliberately does not guarantee, with
the same honesty discipline as this page, at referee depth. It also tells the
project&rsquo;s best war story: the mechanized model caught our own deployed
verifier omitting a single condition of RFC&nbsp;9162 invisible to ordinary
testing, 3,867 wrong acceptances across 73,573 adversarial cases, zero after
the one-line fix. If you read one thing, read the claim matrix at the end:
every promise, what establishes it, and what remains assumed.</div>
<p class="muted">Log heads are signed offline; this service is read-only and holds no