Operator-caught: 'certificate' used before any definition, 'requirements
card' undefined, and the Attested-libraries table headed 'artifact 2 /
artifact 3' — numbers pointing at a DIFFERENT table. Fixed: certificates
defined in the Merkle intro (each leaf = one proof run, a batch of
certificates: one machine-checked theorem with its assumption list);
the requirements card is now 'a short plain-text file listing, by name,
the assumptions you accept'; table headers are self-describing (library
/ claim (attestation) / proof of inclusion (receipt) / certificates
proven); redundant gloss under the table dropped (say it once). My own
fresh re-read on top: 'head' glossed at first use, keys card says
'entry 18' (leaf comes later, at the Merkle mapping), 'Binds artifact 2'
de-numbered, 'become a witness' now plain ('hold the complete history
yourself, rung 1'), 'risk class R5' dropped from prose, the legend says
'every assumption list exactly as declared' instead of 'boundary-exact'.
The 'Paper and log, one story' card served OUR revision history, not
the reader — removed without replacement. SHA-512 appeared unexplained;
now its first mention says why it exists in assumption lists at all
(the hash inside Ed25519, treated as an assumption, not as proven).
Operator: 'additive' explains nothing to a newcomer, and Key 2 carried
its full parameter-set name while Key 1 was just 'Ed25519' — unequal
treatment. Now: 'Key 1 — Ed25519, required' / 'Key 2 — SLH-DSA
(FIPS 205), post-quantum'; the second signature is called exactly that,
'the second (post-quantum) signature'; parameter-set precision stays in
the artifacts where it belongs. Same cleanup in the OpenAPI summary and
the CLI help.
Operator-caught: rung 2 demanded both public keys while the shown
command consumed only the Ed25519 one — and the gap was real: pacta had
NO SLH-DSA head-signature check (only the mirror's verify.py had one;
'--require-signatures both' refers to the empty ML-DSA slot). New:
verify_receipt(slhdsa_public_key_path=...) verifies the additive
co-signature fail-closed (absent on pre-14 heads reports absent, not
failed; unavailable OpenSSL fails closed), CLI grows
--slhdsa-public-key, rung 2's command carries the flag and its muted
text explains both checks. Proven against the LIVE log: accepted:true,
slh_dsa:verified, ed25519 on the dogfood backend. New tamper test
flips a signature byte and must be rejected. Suite 156 green.
Operator critique, all points: no narrative opener (the page now begins
'This site is a public notary for machine-checked proofs...'); subjects
stated symmetrically and completely (signature-CHECKING code in four
Ed25519 libraries, an SLH-DSA implementation, and the log's own Merkle
machinery — the accumulator leaf was missing before); the redundant
'same thing, in one precise sentence' paragraph is gone; every ladder
rung now labels its preconditions ('You need: ...') before any command
and explains what the command does and what a green result means; no
forward references to the paper before its own section; the key card
opens 'Two keys sign everything in this log' — never again 'This key'
— with Key 1/Key 2 structure; the API box is REMOVED from the page and
replaced the industry-standard way: an OpenAPI 3 document served at
/openapi.json (new route + test), one footer line points to it; the
footer carries no commands; the paper card references rung 1 instead
of dropping a bare command. Suite 155 green.
Operator order: coherent, precise, accessible — an undergraduate CS
student must understand what the service provides, how to benefit, and
what to DO from each trust angle. The page now opens in plain terms
(what happened, why this site exists), keeps the precise one-sentence
as the second voice, and replaces 'Three ways to use it' with the
FIVE-rung trust ladder: (1) witness — hold the history honest, one
minute; (2) trust the reports, bind the operator — milliseconds;
(3) accept observations, reject judgment — re-derive verdicts from
recorded cones against your own card, the rung most people miss;
(4) replay the proofs yourself — ~30 min/library; (5) rebuild the whole
path — weeks, floor named (kernel/extractors/compiler; no rung 6).
Split-view comparison stated as orthogonal to all rungs. The API box is
demoted to 'For your tooling — the raw API' at the bottom with its
reason for existing stated (machine consumers; pacta builds on it).
All content guards keep their exact phrases; suite 154 green.
(The guard did its job — the suite was red after the heading fix and my
verification chain swallowed the exit code through a pipe and deployed
anyway. Chain hygiene restored: pipefail on every gate invocation.)
Operator-caught logical fallacy: the h2 said 'pin this key' (singular)
and the card said 'sole identity anchor' while the same section
presents a second, additive post-quantum key ('sole' + 'Second anchor'
in one breath). The heading is now plural with the hierarchy stated;
'sole' became 'required' in both places it appeared; and 'exactly three
files' now names the optional fourth (the additive PQ key). Root cause:
the SLH-DSA block was APPENDED to the section in August without
re-reading the section against its own heading — local edit, no
whole-unit re-read.
Operator-caught, by eye: the accumulator graphic was designed for 8
leaves (fixed 112px boxes, fixed 380px head box) and has been a
shingled overlap since the log reached 19 on 2026-08-08; the head
caption spilled both sides after today's wording grew. Every 'site
verified' since was text-probes — nobody rendered pixels. Fixes:
leaf boxes now size to their span (rich >=100px, compact below, short
names, hash line dropped when narrow); the head box computes its width
from its longest line and carries the caption on two lines; edges
anchor to the actual box top. New regression test renders the tree at
8/19/33 leaves and asserts no two leaf rects overlap and the head
title fits its box. Suite 154 green. Eye-passed locally before deploy.
Operator order: the leaf-index convention adopted this morning must be
global. Paper1 now says leaf 12 in every place that said entry 13
(intro, contributions, section 7.2, related work, conclusion, artifact
availability, Appendix B retitled 'Deployed leaf-12 scope'); the
ordinal 'thirteenth entry' survives only as a gloss. v0.12, 25pp, gate
green, Appendix B page eye-checked. Site card follows (v0.12; revision
prose de-versioned so it cannot churn), paper/README history extended,
top README says leaf 12/17/18. reinvention-outline moved to the private
control repo earlier this commit-series (moat doctrine).
ESTATE.md was still the 2026-07-22 snapshot (13 leaves, v0.9, 'SLH-DSA
NOT in the log'); llms.txt still said thirteen leaves, 23 pages, and
linked the retired /paper/v0.x routes; README repeated the stdlib-only
verify.py trap the site just fixed; evidence/README called the July
capture's 16/16 attestations 'definitive' and its 8-leaf state current.
All brought to truth. Entry numbering standardized on 0-based leaf
index with 'the thirteenth entry' as the ordinal gloss (docs, lab
manual, security note, mirror README template). Operator-machine path
removed from provider/README.
Operator-caught nuance: the plain-lead sentence ('the code that signs
the log is itself an entry in the log') invites the exact over-read
Green warned about — statement-scope sensitivity. The lead and the SVG
caption now state the boundary inline: the attested entry proves the
VERIFY path; no signing code is proven, here or anywhere.
Operator-found (and root-caused): the v0.11 card replace had silently
no-opped on an invisible NBSP in 'vs.\xa0today' — the page said 23 pages
and still carried the July-snapshot card one paragraph under the 'New in
v0.11' sentence. Fixed by byte-anchored replace with post-assert; a
source regression test now forbids the stale markers outright and
check-paper.sh binds the page-count claim to pdfinfo.
Executability (tested by actually running them): the printed curl had no
scheme and returned empty through the redirect -> https form; the
zero-install one-liner was missing its cd -> added; 'Standard-library
Python only' contradicted the openssl requirement stated 20 lines
earlier -> made honest; 'table above' pointed at a table that is below
-> below; '~25 lines of Python' vs the 346-line fail-closed verify.py ->
'one-page core (paper Appendix C), shipped verify.py wraps it'.
Comprehensibility (fresh-eyes audit, 28 findings triaged): first-use
glosses for STH, axiom cones, certificates, pinning, split view,
pins.json, trusted base, residual-risk list, R0-R5, signature tiers;
Lean 4 linked; Merkle accumulator glossed; operator=provider declared;
the ✗-leaves explained as the failed round 1 vs clean re-attest; the
flagship self-reference gets a plain lead sentence; TOFU named and
bounded; pacta install source at the first pacta command; coined verb
'machine-re-check' uncoined; pitch parenthetical trimmed (SLH detail
lives in its own block).
Suite 153 green (new: webdocs stale-claim regression test).
Triggered by the operator's hint (references flow into App A but a full
break sits between B and C). Full-document inspection found and fixed:
- ghost page 23 (~85% blank): the fossil \clearpage before Appendix C,
placed under an older pagination, removed; appendix policy now
DECLARED: the block starts on a fresh page, then flows with no
internal breaks
- claim matrix (the paper's honesty centerpiece): solid-set rows merged
visually and narrow justified columns gaped (badness-10000 in every
build log, never read) -- now ragged-right columns, 3pt row air,
EUF-CMA/SHA-256 unbreakable
- Figure 3 still drew the July 13-leaf snapshot in a v0.11 paper that
narrates 19 leaves -- extended: leaves 13-18, August-2026 brace,
dual-signed size-19 head box, pq-styled leaf 18
- ConsRec hyphenated as Con-sRec and set in serif vs sans elsewhere ->
math-face identifiers in the mechanization table
- 'tuple' stranded its last syllable as a whole line in Definition 1;
'timestamp' broke as times-tamp -> mbox + \hyphenation
- thesis box hyphenated its showcase slogan -> ragged-right no-hyphen
(first attempt justified+nohyphen was caught by the new gate itself)
- Appendix E header caps + layer-cell caps + continuation row cleanup;
related-work 3.4pt overfull removed
- NEW check-paper.sh: fails on overfull>10pt, any badness-10000, ghost
pages (<300 chars/page), missing version on title page, ?? refs;
4-check selftest; renders all pages for the mandatory eye pass
All 25 pages re-rendered and flipped by eye. Gate green. Tests green.
The transparency-log section still said 'published heads remain
Ed25519-only until the next publication' (undated, false since
2026-08-08) and 'live at 13 leaves'. Brought both to the v0.11 truth,
including the entry-12-through-18 narrative (zero-indexed, matching the
paper's leaf numbering).
The freeze rationale is gone (review concluded); v0.11 describes the
LIVE deployment instead of the July snapshot:
- abstract + contributions: nineteen leaves, four Ed25519 corpora at 44
certs, the accumulator's two attestations, leaf 18 = the SLH-DSA
verify path; heads dual-signed since size 14 with the parameter set
the log itself attests
- signed-tree-heads section: the additive deterministic SLH-DSA
co-signature, ABSENT-not-failed history honesty, determinism as an
audit primitive, the closed loop to leaf 18
- new instantiation subsection 'The SLH-DSA verify path: the method on
second terrain': 11 certificates, acceptance characterization, the
no-second-semantics honesty (visible-not-correct), exact cone
enforcement, scope (mono facade + 137-case bridge, base_2b, no
signing)
- deployment/public state: 15 August 2026, root 7ee23940, twelve heads
8-19, per-leaf narrative through 18
- NEW Appendix E: the eleven SLH-DSA certificates with their exact
oracle cones — the mirror of Appendix D's Ed25519 tiers
- title: v0.11; site card + snapshot note + paper/README updated
25pp, zero unresolved refs, Appendix E render-inspected by eye; full
test suite green
Operator finding 2026-08-15: the live site still said 'v0.9 — frozen
while under journal review' and advertised the superseded v0.1/v0.2
drafts. Fixed at the source:
- webdocs.py paper card: v0.10, revised August 2026 (version now also
printed on the PDF title page); the divergence description gains its
closure (the sn=0 conjunct, zero divergences, three-way regression);
the freeze-era reconciliation card shrunk to a tight snapshot-vs-today
paragraph; fragile '12 Jupyter lectures' count dropped
- web.py: /paper serves the current paper only; all old-variant routes
404 (git history retains the drafts); ltl-v0.1/v0.2 files removed from
the working tree, paper/README updated
- ltl.tex: title page now reads 'Revised: August 2026 — v0.10' (the
version travels IN the PDF, per operator order); rebuilt
- tests updated to ENFORCE the retirement (all old variants must 404);
full suite 152 passed
The review process concluded 2026-08 (operator released the hold). Folds
in exactly the staged erratum-queue + v0.10 items, nothing else:
- corpus count sentence made historical (sixteen at the studied leaves;
forty-four per fork since — the log records both generations)
- the 3,867/73,573 divergence finding gains its closure everywhere it
appears: root cause = deployed verifier omitted RFC 9162 S2.1.4.2
Step 7's terminal sn=0 condition (fixed in ddbb5a4); zero divergences
post-fix, three-way regression
- new limitations paragraph 'Replay-harness integrity' (a wrong
observation needs no malice)
- adversary model: defective-harness clause
- claim matrix: 'recorded cone was produced by an audit that performed
its checks — not established' row
- title page carries 'Revised: August 2026'; submitted v0.9 (7f140356)
preserved in git history; paper/README signpost updated
paper/README.md tells a visitor that ltl.pdf is the submitted version
frozen during review, that v0.1/v0.2 are superseded history, and that
v0.3-v0.9 live in git history. Also corrects the stale web.py comment
that labeled the live pdf 'v0.3 reinvention' (it is the v0.9 submitted
version). No served bytes change; the comment fix reaches the droplet
with the next routine app update.
For newcomers with no Lean and little crypto: the notary-ledger reading of
the log paper, the honest-or-caught guarantee in words, the frozen-snapshot
note, the two-acts framing of paper 2 — and a straight answer to "which
buttons?", since the jargon trips exactly the reader this page is for.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The estate doc audit scoped itself to *.md and missed the text a site visitor
actually reads: the string constants in webdocs.py. Fixed here, verified by
RENDERING the page from the live 19-leaf state and checking each block:
- The SVG head label reads "Ed25519 + SLH-DSA" when the live head is
dual-signed, "Ed25519" when it is not — computed, not asserted.
- The trust-anchor card now carries BOTH keys the same way: full PEM,
SHA-256 fingerprint, raw endpoint (/v1/log-slhdsa-public-key), mirror
comparison link. The Ed25519 key stays the required anchor; the SLH-DSA
key is the additive post-quantum one, and the card says whose proof
subject its verify path is (leaf 18).
- The registered homepage overclaim (register: homepage-stdlib-claim) is
closed: "stdlib-only" wording replaced with the truth — stdlib hashing,
signature checks shell out to the openssl binary, fails closed without.
- "one signature and ~N hashes" became "one REQUIRED signature (Ed25519;
heads from tree 14 add an additive post-quantum SLH-DSA signature)".
- The paper card is reframed (frozen under review, describes the 16 July
snapshot, "then-thirteen-leaf") and followed by a new reader-guidance
card (operator-ordered): the paper-era prefix is unchanged inside the
live history — leaves 0-12 byte-identical, the paper's head still
head #5 of sth-history — verify.py --all checks both eras at once; the
advances are additive (44-cert re-attestations, leaf 18, dual-signed
heads, ABSENT on older heads by design); and the 3,867 divergence the
paper honestly reports has since been CLOSED (sn==0 fix, 2026-07-23,
pinned count now 0) — both the divergence and the fix are part of the
retained record.
Layout fact the render surfaced: the served log dir must contain the .pub
files (that is what /v1/log-public-key reads); the SLH-DSA pub joins the
Ed25519 one there. Suite 152/0/0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
/v1/log-slhdsa-public-key, mirroring /v1/log-public-key exactly: same route
shape, same two-independent-locations TOFU rule (site copy + git mirror
copy). The operator decision of 2026-08-06 required the SLH-DSA public key
published like the Ed25519 key; the mirror half shipped with the tree-19
publication, this is the site half. Suite 152/0/0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Nine parallel readers audited every doc against measured ground truth; every
finding was re-verified against the file before any edit, and the sweep fixed
by PROPERTY, not by flag — wording the readers caught in one repo was hunted
in all siblings (the two-button README sentence existed in all four forks,
not the three flagged; likewise the cone-overclaim in TRUSTED-BASE item 1).
This repo: see the diff. Records were not rewritten; clarifications are
dated. Doc-only except where noted in the estate summary; every gated doc
change was followed by a green button run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The consumer verifier now judges the slh_dsa block on every head. The status
taxonomy is the design decision, so it is spelled out and each arm tested:
ABSENT head predates the second signature — allowed (additive posture,
operator decision 2026-08-06); an append-only log keeps history.
VALID verified against provider.slhdsa.pub.
INVALID present and wrong — HARD FAILURE. A bad signature is never a
degradation.
WRONG-KEY head names a different key than the mirror ships — hard failure.
NO-PUBKEY head claims the signature, mirror ships no key — broken
publication, hard failure.
TOOLING OpenSSL < 3.5 cannot read SLH-DSA keys — honest degradation:
one loud NOTE, never counted as verified, never failed; the
required Ed25519 checks still gate the result.
verify_selftest.py gains two adversarial cases, both mutating a full mirror
copy: one flipped signature byte must fail naming slh_dsa:INVALID; deleting
provider.slhdsa.pub while heads claim the signature must fail NO-PUBKEY. On
mirrors without slh blocks the cases record as not-applicable rather than
silently passing. First selftest run caught my own marker bug — the case
grepped for the stored failure string, which is never printed, instead of
the printed status; the printed line is now the assertion target.
README template: SLH-DSA key row, honesty paragraph (verification proven for
both algorithms, signing for neither; leaves Ed25519-signed at issuance
only), and the hardcoded head size is GONE — the README now names no tree
size at all, so this staleness class dies with the instance (it said "tree
size 13" and would have shipped that under a 19-leaf head).
Template is deliberately ahead of the published mirror until the next
publication, which overwrites the mirror from here (the sync rule's
intended direction for pre-publication work). Proven against the scratch
19-leaf mirror: verify.py --all RESULT OK [full] with ABSENT on heads 8-13
and VALID on 14-19; selftest 13/13 GREEN. Backward compat proven against a
copy of the live 13-leaf mirror: RESULT OK [full], selftest GREEN with the
slh cases n/a. Suite 152/0/0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
append_attestation and latest_sth pass the keys to make_signed_tree_head so
every head minted during an append cycle carries the dual signature; publish
ships provider.slhdsa.pub beside the Ed25519 key the moment it exists. All
three parameters optional and defaulting to absent: a caller without SLH-DSA
keys gets exactly the previous behaviour, heads carrying the honest
not-configured slot. Suite 152/0/0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Closes the two halves of replay-pipeline-lags-hardened-forks.
(1) The generic replay compiled every .lean under verification/, including the
P1-b kernel-gate instruments (Proofs/Inventory*.lean) that read other modules'
object files via readModuleData and only run inside the button's environment;
it died with "object file does not exist". New RepoConfig.replay_exclude
(globs, per repo, in the config where a reviewer sees them) filters the
compile; every exclusion actually applied is recorded in the attestation's
replay.instruments_excluded, so the LEAF discloses what its replay did not
compile — a silent exclusion here would be the estate's oldest defect class.
The replay checks the certificates; the deeper self-auditing gates are the
repository's own and run there.
(2) The ed25519 profile's default list still carried the 16 pre-hardening
certificates, so a successful replay would have attested 16 and the whole
16->44 point of the re-attestation would have been lost silently. Each fork
entry now carries its own 44 — 27 main + 4 apex + 13 scalar — MEASURED from
the fork's two buttons (CERTS arrays; apex recovered by the same pattern
Phase 3c itself uses), never hand-typed. Correction to the plan on the way
through: the plan said 40; the apex tier makes it 44.
Suite: 152 passed, 0 failed, 0 skipped.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
First slh_dsa-kind repo. The 11 certificate names and every per-certificate
cone are GENERATED from the repositorys own pinned AUDIT-MANIFEST.txt, not
hand-typed; the apex resolves to kernel-3 plus the five verify-path oracles.
Exclusions carry TRUSTED-BASE items 2/9/10 into the leaf: hash oracles
assumed, signing/keygen out of scope, everything above the extraction root
(including the pure/prehash domain-separator byte) uncovered, the deployed
bridge a 137-case differential test.
Dry-run green: 11/11 proven+clean at d44b70d8, attestation signed
verified-dalek-serial.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Phase 2b+3 of the step-3 rehearsal, under the four operator decisions of
2026-08-06: deterministic signing, separate slh_dsa block, additive posture,
keygen executed same day (key in provider state, 0600, git-ignored — verified
before generation, not after).
src/pacta/slhdsa.py — the module that did not exist (register:
pq-slot-names-unproven-algorithm). Parameter set LOCKED to SLH-DSA-SHA2-128s:
every entry point asserts the key's reported algorithm and refuses anything
else, because any other set sits outside all eleven certificates while looking
like dogfood. Deterministic via -pkeyopt deterministic:1, so the byte-level
reproducibility check that caught a real defect on the Ed25519 side survives
here. Verification runs two ways: OpenSSL, and pacta-verify-slhdsa built from
the pinned proven source — the one signature check in the estate performed by
code whose verify path the certificates cover. The proven-verifier path is
package-anchored, not cwd-relative: the lesson of signer-backend-depends-on-cwd
applied on day one, not retrofitted.
make_signed_tree_head grows optional slhdsa key parameters. With them, the head
carries a signed slh_dsa block; without, an honest not-configured slot exactly
as ml_dsa always has. ml_dsa itself is untouched. Signatures stay outside the
signed payload for both algorithms — tested by asserting the payload is
byte-identical with and without the slh_dsa key.
Honesty carried in the artifact: signing_backend says "openssl" because no
proven signer exists for any algorithm; the module docstring states that
nothing here is Lean-proven and that the certificates cover the verify path of
the extracted model only.
Tests: 7 new, suite 152 passed, 0 failed, 0 skipped — including determinism
(two signings, identical bytes), the foreign-key refusal (Ed25519 key raises),
corruption rejected by both verifiers, and the proven/OpenSSL agreement.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fifth quorum member, first post-quantum one: verifies an SLH-DSA-SHA2-128s
signature by calling slh_verify_128s, the extraction root the eleven fips205
certificates cover (apex fips205.slh_verify_128s_accepts_iff). Verify-only
like the other four: quorum members judge, they never sign.
Build discipline, because "built from the proven source" is a claim that has
to survive a hostile reader: build-verify-slhdsa.sh REFUSES to build if the
pinned checkout is dirty or at any commit other than a3ce8e8, exports the
pinned commit via git archive (never a working copy), applies
expose-mono.patch to that scratch copy, and then DIFFS the patched
verify_mono.rs against the pinned one, aborting if any existing line changed
rather than being appended. The patch is a visibility keyword plus its doc
comment (the crate denies missing_docs, so pub mod alone does not compile)
and one appended argument-assembly function whose body is the crate's own
test helper. The extraction root is provably untouched. A provenance sidecar
lands beside the binary: source commit, patch hash, main.rs hash, rustc, and
a not_covered field naming what no certificate reaches — M-prime assembly
(including the pure/prehash domain-separator byte), hex/file IO, the
compiler; signing and keygen out of scope entirely.
Demonstrated against OpenSSL 3.5.5 on a throwaway key: valid signature OK
both ways, wrong message INVALID, corrupted signature INVALID. The agreement
is itself a finding — this binary assembles M' = 0x00 || 0x00 || payload
(pure variant, empty context) and OpenSSL evidently does the same.
Convention matches the other members: template + main.rs + patch + build
script tracked; rendered Cargo.toml, lock, target/ and the .build-slhdsa
scratch tree ignored.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
DEFAULT_STATE_DIR was Path("dogfood")/"state" -- a relative path, so
locate_verifier() resolved against whatever directory the process started in.
The consequence was not a crash but something quieter: run the provider from
the repository root and it signs with the attested dalek build; run it from
anywhere else and the binary is not found, signing falls back to OpenSSL, and
the head records `signing_backend: openssl`. Which implementation signs the
transparency log was an accident of the current directory.
Found by re-signing published head 13 as a reproducibility check. The byte
comparison passed -- the reconstructed payload re-signed to signature_base64
exactly -- but the backend came back `openssl` while head 13 records
`verified-dalek-serial`. The swap is invisible precisely BECAUSE Ed25519 is
deterministic: both implementations emit identical bytes, nothing downstream
differs, no test fails. A silent substitution that changes no output is one
nobody notices until the outputs differ, which for a signing key is late.
(The byte-identity is also a good result in its own right: independent
cross-implementation agreement on the SIGNING side, alongside the five-way
agreement already demonstrated on the verifying side.)
Fix: anchor to the package via Path(__file__).resolve().parents[2]. Resolution
no longer depends on cwd -- demonstrated from /, /tmp and the repo root, all
three now select verified-dalek where before only the repo root did.
Added PACTA_REQUIRE_VERIFIED_SIGNER. Recording a downgrade truthfully, which
this code already did, tells you afterwards which implementation signed; it
does not let you DECIDE which one will. For signing a transparency-log head
that choice should be stated up front and enforced, not discovered in a
provenance field once the head exists. Set it and signing raises instead of
substituting OpenSSL. Off by default: every existing caller keeps the
fall-back-and-record behaviour.
Negative-tested both ways (refuses, naming the path it searched; default still
records `openssl`). Suite: 145 passed, 0 failed, 0 skipped.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The /estate page was hand-written prose inside estateview.py: 32 hard-coded
fact arrays and zero places reading live data, last edited 2026-07-22. It
cannot go stale by accident — it can only go stale, because nothing connected
it to the repositories it describes. For eight days it told the operator:
· SLH-DSA "campaign in progress", "check.sh exits non-green by design"
— while it had 11 proven certificates, a green button, an 18-attack
self-test and an outside reviewer's attest-with-conditions;
· ed25519 "16 reviewed certificates"
— while they had 31 bound certificates and 3022 inventoried constants;
· nothing at all about five audit phases and five self-tests per repo,
none of which existed on the day the page was last touched.
Those four claims are corrected. More importantly the page now carries a
MEASURED panel rendered from formal-verification-control's
tools/estate-progress.py, which derives every figure from the repositories at
generation time. The panel states three things a reader would otherwise have
to assume:
· WHEN it was measured, and by what;
· WHETHER the repositories have moved since — the snapshot records the HEADs
it was taken against, and the panel compares them live, naming any repo
that has moved rather than quietly showing old numbers as current;
· WHICH PART OF THE PAGE IS MEASURED AT ALL. Everything above the panel is
labelled, in the page itself, as hand-written prose that can be out of
date. That label is the honest part: the map is still prose, and a reader
should know which half is which.
If the snapshot is absent the panel says NOT MEASURED in words and prints the
command to produce one. It never renders nothing, and never falls back to
prose — a blank space and a confident-looking stale figure are the same
failure, and the second is worse.
Two numbers, never one, per PROGRESS-METRIC.md: a single figure is what let
the old metric report 100% for work nobody had attacked.
All three paths tested: current, moved-since, and absent. 145/145 tests pass,
including the sync test guarding drift between this page and ESTATE.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The estate document had SLH-DSA at 'zero certificates, check.sh non-green by
design' since 2026-07-22, through the entire eight-round review campaign and
the completion of the verify-path pyramid. A hand-maintained document
describing repositories it never reads will go stale exactly this way.
The durable fix is formal-verification-control/tools/estate-progress.py, which
derives its numbers from the repositories at run time and refuses to report
progress while its ledger contradicts them. These rows are corrected by hand
only because this file is prose, not a dashboard.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The deployed consistency verifier implemented the RFC 9162 2.1.4.2
bit-navigation loop but its final return checked only the two
reconstructed roots, omitting the terminal condition that the new-size
navigation counter reach zero. That condition couples the consumed proof
length to the claimed tree sizes; without it, a valid proof for one
transition verifies under a lied (power-of-two) old size. Flagship: a
valid 2->3 proof is accepted under the false claim 1->3 with the size-2
root.
Fix: add `and sn == 0` to the final return.
This is the corpus's Known Gap 14 (3,867 deployed-accepts-only cases in a
pinned 73,573-case family, recorded in public log entry 13). It was
found by the project's own differential harness; a post-appeal review
round added a faithful RFC oracle as a third comparison, which showed
the deployed verifier — not the mechanized model — was the one deviating
from RFC 9162, and traced it to the missing terminal check.
Scope: verify_consistency's only production caller is the consumer-side
pin store, reached only behind a verified head signature. Generation is
RFC-correct and unaffected; the live provider service does not run this
verifier; the published standalone verify.py has no consistency verifier.
An empirical search found 0 realizable pin-advance poisons against an
honestly pinned consumer, consistent with Known Gap 14's non-claim.
Verification:
- New fail-first three-way regression test
test_consistency_lied_size_three_way_agreement (deployed / recursive
ConsRec model / independent faithful RFC 9162 transliteration) over the
honest AND lied-size families; fails pre-fix, passes post-fix.
- Historical differential tests (164,479 inclusion; 164,224 consistency)
unchanged — the fix rejects nothing honest.
- Full suite: 145 passed, 0 failed.
Public log entry 13, the attested accumulator commit, and the IACR
submission PDF are all unchanged. Vulnerable state tagged
vulnerable/sn0-consistency-fd2f6ba. See
docs/security-2026-07-23-consistency-terminal-check.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two repos joined the estate on 2026-07-22; both renderings (ESTATE.md +
cockpit /estate) gain their cards, with every fact recomputed from the
repos themselves:
- fips205-source (upstream lane): verbatim snapshot of
integritychain/fips205 (pure-Rust FIPS 205 / SLH-DSA), upstream pin
30bac08, snapshot head 5dca0db — single deviation: upstream CI
workflows stripped, documented in-commit. Aeneas-compat patches land
there as transparent, individually-justified commits; nothing is
proposed upstream.
- fips205-slhdsa-verified (subject lane): SLH-DSA-SHA2-128s verify-path
campaign, marked exactly as its own check.sh says — CAMPAIGN IN
PROGRESS, zero certificates, non-green by design. NOT attested; the
map does not imply otherwise.
Also:
- liveness board now probes fips205-slhdsa-verified (a sibling under
the default repos root). fips205-source is deliberately NOT probed:
the upstream-source shelf lives outside that root, like the five
existing source clones (comment documents the decision).
- drift tripwire (test_estate_view_and_estate_md_do_not_drift) extended
with both new sentinel names.
- stale fact chip refreshed in both renderings: pacta suite 135 → 144
green (the suite grew during the cockpit era; chip was never bumped).
- estateview's pasta dossier no longer calls the curve layer "the one
open verification task in the estate" — the campaign is a second.
Suite 144 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Audit: are the zero-to-hero notebooks current and macOS-runnable, and
does the README present the new teaching surfaces and CLI well?
Verified by execution: all 14 notebooks run headlessly cell-by-cell,
offline, pure-Python (zero shell magics), degrading gracefully where
Lean/built binaries are absent — before AND after these edits. That is
also the macOS answer: no GNU userland is touched by any cell.
Gaps found and closed:
- README's notebook list stopped at 10; notebook 11 (the customer's
eye view) now listed.
- No notebook knew the cockpit era existed. Three pointer cells added:
00 (course map: the three-track teaching stack — notebooks = code
track, lab manual = role track, guide = reference), 10 (see the
wallet you built through the cockpit; --demo and --wallet forms),
11 (the Inspect instrument is this notebook's recomputation, живой).
- README: cockpit command block now shows --demo, --wallet, --port/
--host variants; curriculum section names the teaching stack and the
notebooks' offline/runnable contract.
Suite 144 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Audit question: is the documentation coherent, and is the app portable
to a fresh machine (macOS) with proper isolation? Findings and fixes:
- README never mentioned the cockpit/deck/lab manual (three rounds of UI
evolution invisible at the front door). Added: human-surface section
with the one command, expanded Install (editable-from-clone is the
supported mode — repo files are part of the product; zero-install
PYTHONPATH=src alternative; fresh-machine skip behavior), macOS
openssl/LibreSSL Ed25519 prerequisite with a one-line self-check,
wallet commands in the command list.
- The lab manual violated the repo's own macOS law (AGENTS.md): GNU
sha256sum -> shasum -a 256; GNU sed -i -> portable python3 -c
one-liner (executed and output-matched before shipping: entry 0 hash
mismatch, BROKEN, exit 1).
- Fresh-clone bootstrap was actually tested end to end in a scratch
clone: zero-install suite 130 passed / 0 failed / 14 skipped after
fixing the one unguarded test (test_ledger_is_hash_chained now skips
like its siblings when the dogfood binary is absent - capability gap,
not failure); venv + pip install -e . -> pacta console script serves
bridge/deck/manual/sample-prefill/drift-tripwire with no PYTHONPATH.
- PYTHONPATH incantations simplified: cockpit needs src only (provider
never imported by src/pacta); manual + cockpit.md updated.
- threat-model.md: cockpit attack-surface note (no mutating routes,
no auth because nothing to operate, localhost-only disclosure risk,
probe-only network I/O, fake-cockpit = host-compromise boundary).
- products.md: cockpit named as the shared human surface of all four
profiles. AGENTS.md: doc-portability law + the cockpit's three laws
added to the standing guidance.
Suite 144 green here; 130/0/14 on a bare clone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator asked for a real big fat user manual: read on one monitor with
the deck on the other, worked like a lab from beginning to end, with
highest didactical skill — the goal being to educate ONE person in ALL
roles, as if to BECOME each role. Shipped as a full course:
- docs/warden-lab-manual.md (canonical, ~7100 words): 8 sessions +
capstone. Fixed didactic ritual per role-session: why the role exists
-> the mind of the role -> concepts -> LAB (numbered machine exercises
with checkpoint rails) -> never-list with whys + thought experiment ->
handoff artifact -> self-test -> recap card. Notation: do / checkpoint
/ write / optional. Capstone 'incident day': one incident walked
through all six chairs producing seven written artifacts; graduation
session maps the path to a real wallet; Appendix A command reference
by chair, Appendix B full self-test answers.
- Session 4's tamper drill: copy the demo wallet, flip one character of
ledger history, watch verify-ledger AND a second cockpit catch it.
Every checkpoint in the manual was executed by the author before
commit: status fields, intact-chain exit 0, tampered-chain 'entry 0:
hash mismatch / BROKEN' exit 1, CUSTODY EVIDENCE BROKEN banner.
- src/pacta/mdlite.py: deliberately small stdlib Markdown renderer
(headings/anchors+TOC, bold/italic/code with placeholder stashing,
fences, lists, quotes, tables, links); tested against the real manual
for zero artifact leaks.
- /manual route with syllabus TOC; manual typography (checkpoint boxes,
session borders); nav tab, deck wizard cross-link, cli hint.
Suite 142 -> 144 green; read-only sweep covers /manual.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator asked for a tmux-type panes grid in the browser (one pane per
role, all acting in parallel, like real life) with a wizard on the right
that takes a newcomer by the hand through every role's actions, each
instruction camouflaged in that role's color.
- /deck: CSS-grid of six live panes (2-col, 3-col on wide screens),
one per station, each an iframe onto /station/<id>?pane=1. tmux
controls per pane: reload, single-pane zoom, open-full. Narrow
screens: wizard first, panes stacked.
- pane mode (?pane=1): chrome-stripped shell (no h1/banner/nav), same
station content, READ-ONLY label kept; an 8-line shim re-carries
pane=1 on every same-origin link and form submit, so probes, incident
browsing, and inspect verdicts all happen inside the pane.
- the wizard: a 10-step guided first watch across all six roles on the
live demo wallet. Each step card wears the role's hue with a 'YOU ARE
THE <ROLE>' chip, the matching pane glows, and every step states what
success looks like + what was just learned. Step remembered per
session (sessionStorage).
- /inspect?sample=1 pre-fills examples/wallet-evidence so the
cryptographer step verifies (then deliberately breaks) real evidence.
- verified in a real browser: step navigation moves the glow, panes
load their stations, Probe-now inside the pane probed live inside the
pane (log head tree_size 13), sample flow prefilled the key in-pane.
Suite 139 -> 142 green. Read-only guarantee unchanged; byte sweep
covers /deck and pane routes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator verdict on round two: better, but 'still no coherent
application'. The cockpit must provide everything a human crew would
need if no AI were around — as distinct roles that cooperate through
handoffs and never melt into each other. This rebuilds the IA as a
bridge with six stations over shared instruments, in the control-room
tradition (overview -> station -> instrument -> raw files/CLI), with
maker-checker separation of duties encoded in the UI itself.
- / is now the Bridge: whole-system verdict strip, six crew cards with
live data, and the dispatch (andon) board 'if this happens, who acts'
- /station/{proposer,quorum,operator,cryptographer,architect,newcomer}:
each console has a fixed anatomy: Mission -> Duties (every duty a
runnable, verified-real CLI command - the no-AI drill) -> embedded
live instruments -> 'This station never...' (separation of duties) ->
Handoffs (receives/delivers)
- Operator gets a real liveness board: on-demand parallel probes (HTTP
GET on log head/paper/blog/mirror with observed facts + latency; git
HEAD/cleanliness on all 9 local repos). Never probes on ordinary page
loads. Verified live: caught this very repo as 'alive, dirty' while
building it, and confirmed log 13/3488a2d0 + paper 7f140356
- Architect gets the live drift tripwire (ESTATE.md vs estate view)
- modularized per the standing separation-of-concerns order:
uikit.py (primitives+style), stations.py (role model, pure),
liveness.py (probes), walletui.py (collectors, instruments, routes)
- crew law test-enforced: bridge crew+dispatch, per-station role
contract, station distinctness (signature phrases must not bleed
across roles), explicit-probe semantics; read-only byte sweep now
covers all 13 routes incl. the probe route
- narrow-viewport fix: breakany for unbreakable paths in headings
Suite 135 -> 139 green. Read-only guarantee unchanged: no mutating
routes; every custody act is a printed command, never a button.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator verdict on the first cockpit: unusable, jargon-walled. The
evidence layer was honest but the presentation assumed the reader
already lived inside warden's head. This rebuilds the presentation
layer around a testable UX contract, additive to the design law:
- every page: verdict IN WORDS first (CUSTODY HEALTHY / CUSTODY FROZEN
(LATCHED) / CUSTODY EVIDENCE BROKEN), then evidence, then provenance
- every page: plain-language lead saying what the page answers
- every panel: 'How to read this panel' expander interpreting every
column and pill; jargon carries a ? linking to the glossary
- new /guide view: what warden is, how to read any page, color code,
five-minute tour, 12-term glossary, honest 'what this cockpit cannot
tell you'
- navigation: two-line tabs stating the question each view answers,
present on every page; /estate gets a back-to-cockpit chip
- explained empty states (incidents: 'empty is the good state')
- narrow-viewport fix: tables/pre scroll in their own containers
- estate fact chip updated 130->135 green (both renderings)
UX contract is test-enforced (guide terms, lead+nav+explainers on every
view, empty states); read-only byte-guarantee sweep now covers /guide.
Verified by looking: served --demo, walked all six views in a browser.
Suite 131 -> 135 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The operator ran the documented command and hit the fail-fast (no
wallet exists on a fresh machine) — correct behavior, useless
instruction. seal_demo_wallet() now seals a throwaway DEMO wallet
(fake shell-stub members, DEMO-labeled fields, temp dir named
warden-DEMO-*, sample incident/refusal/airgap so every view has
content); 'pacta wallet cockpit --demo' serves it. Exactly one of
--wallet/--demo required. Verified by running the literal command:
all five views 200, demo quorum renders. Suite 130 -> 131.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator questions answered in code: (1) the estate map now lives IN the
cockpit too — /estate serves the interactive map (lanes, typed edges,
loops, clickable dossiers) to the same human audience the cockpit
serves; ESTATE.md remains the canonical committed version (renders on
GitHub, reachable by agents via llms.txt, needs no running process), and
a name-level sync test guards drift between the two renderings — the
published_assets lesson applied preemptively. (2) 'What is RUNNING?' is
now answered everywhere: an operations strip on the map (ALWAYS ON:
caddy + the LTL read-only container + Forgejo with its single 03:00
mirror cron, all droplet; ON-DEMAND: append/publish/sign ceremonies,
cockpit, MCP, operator machine only; NOT RUNNING: warden — prototype,
no deployed instance, no funds watched; everything else: static files
or external parties), a per-entity Runtime line in every dossier, and a
verified What-is-running table in ESTATE.md (container commands, :ro
mounts and read_only:true on the LTL service, and the crontab checked
on the droplet 2026-07-20, not recalled).
Suite 128 -> 130 (estate route + drift guard). Local-only as before:
nothing deployed, live estate untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator-ordered milestone, built under an explicit no-risk constraint
while the paper application is in flight: strictly ADDITIVE (one new
module + one CLI subcommand; zero changes to wallet semantics, the
public site, or anything the paper describes), LOCAL-ONLY (never
deployed; binds 127.0.0.1), and READ-ONLY in v1 (human approve/deny is
deliberately deferred — that is a custody-semantics change belonging to
a separately reviewed milestone).
New: src/pacta/walletui.py — four views over an existing wallet:
- Posture: latch state, ledger head with FULL hash-chain
re-verification, pinned quorum members, spending policy verbatim.
- Signature queue: airgap outbox/inbox, observed never operated.
- Incidents & refusals: verbatim records, newest first.
- Receipt inspector: paste attestation + receipt + log key; verdict,
per-signature results, and diagnostics come verbatim from
transparency.verify_receipt — the deployed verifier itself, reused
not reimplemented.
Design law, stated in the module and enforced by tests: THE COCKPIT
RENDERS EVIDENCE, IT NEVER ASSERTS IT. Every panel recomputes at
request time and carries a provenance line (function + timestamp);
anything unverifiable renders a loud FAILED-TO-VERIFY panel — no cached
green, no neutral gray. Panels state what they do NOT prove (e.g.
binary pinning vs source-to-binary correspondence).
CLI: pacta wallet cockpit --wallet DIR [--host --port].
Tests (10 new, suite 118 -> 128 green): recomputed-evidence rendering,
CHAIN BROKEN on tampered ledger, loud failure on collector error,
latched-state rendering, airgap queue states, verbatim incident/refusal
rendering, fail-closed inspector on garbage, real-evidence roundtrip
(skips if example evidence absent), full-sweep BYTE-LEVEL read-only
guarantee (wallet dir hash-identical after all GETs + a POST), and
fail-fast on non-wallet dirs. Rendering additionally verified visually
against a live demo wallet (posture, quorum table, incidents).
Docs: docs/cockpit.md; WALLET.md section; ESTATE.md + llms.txt updated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A public map should list only entities whose existence is already
public or must be public for trust. The private infra repo is now 'the
deployment configuration, maintained privately' (node, edge, and
inventory row removed); the signing-key row no longer describes backup
media; the evidence archive row no longer enumerates contents. Stated
as an explicit rule in the maintenance section.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The endeavour spans ~12 active repos, a generated mirror, a droplet
with three containers, a full-account Forgejo mirror, operator-held
state, and two self-referential loops — enough that oversight was
genuinely lost. ESTATE.md is the canonical committed map: five lanes of
custody (upstream inputs -> verified subjects -> machinery &
operator-held -> published faces -> consumers) as a GitHub-rendered
Mermaid diagram, plus the two loops explained first (dogfood signer;
entry-13 self-attestation), a repository inventory with mutability
classes (frozen / generated / free / operator-only), the services and
operator-held table, an edge glossary, and maintenance triggers.
Lives HERE because pacta is the machinery hub and the only repo that
changes freely; the mirror is generated, the subjects are frozen, and
the book is independent. Linked from README and llms.txt. An
interactive operator's version of the same model exists outside the
repos.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
