The 14-notebook course predated the post-quantum campaign entirely
(coherence findings 10, 11). Now, authored in the GENERATOR and
regenerated (AGENTS.md rule):
- notebook 06: new section 'The second signature that actually shipped:
SLH-DSA' — the deterministic co-signature since tree size 14, chosen
because the log attests its own parameter set's verify path (leaf 18,
11 certs); absent-not-failed for older heads; determinism as an audit
primitive; verify-only always. Plus a runnable keygen/sign/verify/
re-sign-byte-equality demo (honest skip below OpenSSL 3.5) and the
--slhdsa-public-key consumer flag in the policy list.
- notebook 09: the 'post-quantum line' is now three-legged — Ed25519
proven-verify dogfood, SLH-DSA shipped-and-attested, ML-DSA required-
but-honest-unavailable — with the closing point that a slot stops
being aspirational the day its verify path enters the log; stale
16/16 provenance count -> 44/44 (leaf 13 re-attestation).
- notebook 07: policy exercise extended with the co-signature question;
00 course map goal updated; README course listing for 06/09.
- GENERATOR DRIFT REPAIRED in passing: notebook 10's cockpit cell had
been added to the .ipynb but never backported to the generator —
regeneration would have silently dropped it; the cell is now IN the
generator and round-trips (19 cells, content identical).
Suite 157 green.
The trust architecture has exactly two roles and the curriculum now
mirrors that split structurally - the conceptual burden is the design,
stated as such to the student:
- 06a THE PROVIDER'S SIDE (singleton). Domain banner in the provider's
voice. The full build pipeline run live in a scratch log made from
the REAL attestations: verify (Lean replay = the leaf-making step,
the only expensive one - the shipped evidence IS its output) -> leaf
(0x00 domain separation) -> tree -> STH signed via the MERKLEIZED
LIBRARY -> the self-inclusion check embedded in the signature block.
A generated SVG draws the student's own tree: leaves, internal
nodes, root, and the signature box, framed in the provider's domain
color. Closes with the singleton-vs-many justification table
(key/cost/obligation asymmetry) and exercises.
- 06b THE AGENT'S SIDE (one of many). Domain banner in the agent's
voice: you own the public key, the evidence files, ~25 lines of
hashing - and explicitly NO Lean. The COMPLETE RFC 9162 inclusion
verifier is implemented from scratch in one cell (hashlib only, no
pacta imports for the core) and run against the REAL dalek receipt
(leaf 4 of 8, three siblings, dogfood-signed root); then the STH
signature, the provider's signing_provenance read and interpreted
(why the agent still re-checks inclusion itself), the pin store, and
an SVG of the real log with the agent's path highlighted against the
grey leaves it never needs. Cost line: ~4 hashes + 1 signature.
- Lecture 06 now routes students into the pair and states the mirror
rule ("if you cannot say which notebook a step belongs to, you have
not understood the step"); lecture 09 records that dogfood now runs
in BOTH directions; course map + README updated.
Every cell of 06a/06b/09 executed against the real evidence before
commit (SVGs render in Jupyter, fail soft in plain exec). One
generation bug found and fixed: a single-backslash \\x00 in the
generator produced a literal NUL byte in a cell. 50/50 tests green
with the notebook inventory at twelve.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The provider ran its full honest replay against the four verified
repositories on this machine - every Lean compile and axiom audit routed
through lean-guard (memory-capped, core-pinned, single-flight, ~30 min
per fork) - and the results are now shipped under evidence/:
- 16/16 certificates proven per fork, every axiom cone boundary-exact
(the four apex tiers carry their fork's documented SHA-512/wire
boundary axiom-for-axiom), each attestation pinned to the exact repo
commit (dalek 8ded7bc, anza 673c15e, risc0 98a13a6, betrusted
81f614a) and Ed25519-signed.
- All four appended to the persistent transparency log. The log holds
EIGHT leaves: the first four are the initial run's attestations,
which honestly recorded an AUDIT FAILURE (the two pacta bugs fixed in
e87f0e8) - an append-only trust ledger keeps its bad day, and the
fixed run's leaves sit beside it.
- Every receipt re-verified through the FULL stack: dogfood verifier
(backend verified-dalek-serial recorded), STH pin store, freshness
policy. Receipts are freshly issued against the final tree (a stale
mid-run receipt tripped the pin store's rollback defense exactly as
designed; the rollback diagnostic now hints at idempotent re-issue).
- The capstone consequence ran for real: pacta agent with trusted
provider + signature via the proven path + required receipt + pin
store + --require-verified-verifier built the R4-gated library
capsule from ATTESTED evidence (no local Lean replay needed by the
consuming agent).
Docs and teaching updated against the real artifacts: evidence/README
(inventory + re-verify instructions), README "Real Evidence" section,
lecture 5 now re-derives 16/16 verdicts from the REAL dalek attestation
(signature checked on the proven path, provider labels ignored), and
lecture 6 verifies all four REAL receipts and walks a fresh pin store
over them. Every changed notebook cell executed before commit. 49/49
tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The notebooks now carry the same didactic contract as the companion book
(the "ratchet rule", stated in the course map): every load-bearing idea
runs twice - napkin scale, then real scale - and every pair is EXECUTABLE
in the notebook, not narrated.
- Lecture 1: the truth boundary updated to the proven four-tier apex,
with the what-is-still-NOT-proven list (SHA-512, parsers, signing,
wallets) given equal weight.
- Lecture 2: napkin/real scoring pair - a two-certificate toy card
scored in your head, then the shipped sixteen-certificate R4 fixture
through the same function, residual blockers and per-tier boundary
axioms printed.
- Lecture 6: new split-view section. A runnable equivocation drill:
pin a two-leaf view, grow it honestly with a consistency proof, then
present a forged same-size root and watch the pin store name the
attack. Real-scale pointers to --sth-store, log-consistency,
log-audit, and the freshness policy; a new exercise asks students to
construct the lie a size-only anchor check would miss.
- Lecture 7: the wallet gate now swings BOTH ways on real evidence -
a partial card denied at R3, the shipped R4 card allowed - both
runnable.
- Lecture 8 capstone: "design R4" became "audit R4": read the shipped
card like an auditor, then design the R5 discharge plan (parser
specs, verified SHA-512, signing-side, per-fork production-path
mapping).
- NEW Lecture 9, "Eat Your Own Dogfood": the honest coverage ledger of
the proven-path verifier; a napkin PEM decode (the fixed 12-byte
Ed25519 SPKI prefix, read with your eyes) paired with the mechanical
extraction; live backend dispatch; the fail-closed
--require-verified-verifier policy; and the hybrid-PQC section -
proven-classical Ed25519 plus a required-but-honest ML-DSA slot
("blockers get fixed; placeholders get trusted").
Every code cell of the changed notebooks was executed end-to-end before
committing (outputs stripped per house rules). 49/49 tests green with
the notebook inventory updated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
