Operator-ordered milestone, built under an explicit no-risk constraint
while the paper application is in flight: strictly ADDITIVE (one new
module + one CLI subcommand; zero changes to wallet semantics, the
public site, or anything the paper describes), LOCAL-ONLY (never
deployed; binds 127.0.0.1), and READ-ONLY in v1 (human approve/deny is
deliberately deferred — that is a custody-semantics change belonging to
a separately reviewed milestone).
New: src/pacta/walletui.py — four views over an existing wallet:
- Posture: latch state, ledger head with FULL hash-chain
re-verification, pinned quorum members, spending policy verbatim.
- Signature queue: airgap outbox/inbox, observed never operated.
- Incidents & refusals: verbatim records, newest first.
- Receipt inspector: paste attestation + receipt + log key; verdict,
per-signature results, and diagnostics come verbatim from
transparency.verify_receipt — the deployed verifier itself, reused
not reimplemented.
Design law, stated in the module and enforced by tests: THE COCKPIT
RENDERS EVIDENCE, IT NEVER ASSERTS IT. Every panel recomputes at
request time and carries a provenance line (function + timestamp);
anything unverifiable renders a loud FAILED-TO-VERIFY panel — no cached
green, no neutral gray. Panels state what they do NOT prove (e.g.
binary pinning vs source-to-binary correspondence).
CLI: pacta wallet cockpit --wallet DIR [--host --port].
Tests (10 new, suite 118 -> 128 green): recomputed-evidence rendering,
CHAIN BROKEN on tampered ledger, loud failure on collector error,
latched-state rendering, airgap queue states, verbatim incident/refusal
rendering, fail-closed inspector on garbage, real-evidence roundtrip
(skips if example evidence absent), full-sweep BYTE-LEVEL read-only
guarantee (wallet dir hash-identical after all GETs + a POST), and
fail-fast on non-wallet dirs. Rendering additionally verified visually
against a live demo wallet (posture, quorum table, incidents).
Docs: docs/cockpit.md; WALLET.md section; ESTATE.md + llms.txt updated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A public map should list only entities whose existence is already
public or must be public for trust. The private infra repo is now 'the
deployment configuration, maintained privately' (node, edge, and
inventory row removed); the signing-key row no longer describes backup
media; the evidence archive row no longer enumerates contents. Stated
as an explicit rule in the maintenance section.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The endeavour spans ~12 active repos, a generated mirror, a droplet
with three containers, a full-account Forgejo mirror, operator-held
state, and two self-referential loops — enough that oversight was
genuinely lost. ESTATE.md is the canonical committed map: five lanes of
custody (upstream inputs -> verified subjects -> machinery &
operator-held -> published faces -> consumers) as a GitHub-rendered
Mermaid diagram, plus the two loops explained first (dogfood signer;
entry-13 self-attestation), a repository inventory with mutability
classes (frozen / generated / free / operator-only), the services and
operator-held table, an edge glossary, and maintenance triggers.
Lives HERE because pacta is the machinery hub and the only repo that
changes freely; the mirror is generated, the subjects are frozen, and
the book is independent. Linked from README and llms.txt. An
interactive operator's version of the same model exists outside the
repos.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
REAL DEFECT found by the operator-ordered doc-freshness audit:
published_assets.py still carried the PRE-HARDENING fail-open verify.py
and the pre-Tier-2 README as the templates that log-publish drops into
the mirror — the next publish would have silently overwritten the
round-13-hardened fail-closed verifier and the corrected README with
the old versions. Fixed:
- published_assets.py regenerated from the canonical mirror files
(byte-identity verified by round-trip exec), now also carrying
verify_selftest.py; SYNC RULE documented in the module docstring.
- transparency_log.publish() now writes verify_selftest.py too.
- NEW tests/test_published_assets.py pins the security-critical markers
(fail-closed FATAL, RECEIPT_TYPE, verify_receipt, --all receipt
coverage, required fingerprint) so template drift fails CI instead of
shipping.
- test_web_and_witness updated to the hardened verifier's markers —
the published test log now passes FULL signature mode end to end
('RESULT: OK [full]'), a stronger assertion than the old string.
Doc refresh in the same pass:
- llms.txt: thirteen leaves + entry-13 self-attestation + fail-closed
verifier; paper line -> new title, 23 pages, v0.2/v0.1 archives.
- Course (generator + generated 06b notebook): 'the git hash IS the
content hash' -> 'the commit pins the exact source tree';
'irrevocably part of the log every other agent sees' -> 'committed to
the log's signed view, which any agent can compare' (the two Tier-2
scope corrections had never reached the teaching material).
- test_paper_verifiers.py docstring rescoped: its 164k counts are the
archived v0.2 report's citation; the current paper cites the corpus
harness and makes no extensional-equality claim.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator question answered: self-versioning in a submission title block
is nonstandard ('v0.9' subliminally reads pre-release; ePrint/arXiv do
their own version tracking), 'revised' was already removed at v0.3, and
email-plus-ORCID under the author name is standard and stays. \date is
now plain 'July 2026'. Internal version tracking continues in git, the
site card, and SD stamps. Content byte-identical otherwise; 23pp,
0 overfull.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-15 reconciliation: both reviewers ran the mandated rendered-PDF
gate (all 22 pages each, acts stated). They CONFLICTED on one checkable
fact: GPT found the transport figure's s label on the wrong node (the
computed [4,8) parent instead of the consumed [6,8) proof value); the
Fable reviewer certified 'dashed consumed s over [6,8)'. Adjudicated
against the tikz source: GPT RIGHT — my drawing contradicted its own
caption; Fable's script verified the instance's mathematics but misread
the label placement. Fixed (s -> p67 dashed; q47 -> plain computed
node) and CONFIRMED BY RE-RENDER.
GPT's second blocker also real and fixed: Definition 2(i) claimed
'unique accepted opening' (witness uniqueness) where Game PB proves
leaf-value binding — clause (i) now 'an authentic signed view and a
uniquely determined leaf value at its claimed position'; Appendix A row
aligned ('authentic opening with a position-bound leaf value').
Layout (all confirmed by rendered inspection): figure relocated after
the transport introduction (no longer floats between Theorem 4's
statement and proof); Lemma 4's full statement held together
(samepage); Appendix C given its own page — heading + scope warning +
complete code + Appendix D on p23 (clearpage; 22 -> 23 pages).
GPT optionals adopted: abstract 'one project-specific uninterpreted
SHA-256 boundary axiom'; adaptive-oracle sentence defining Q; corollary
overhead phrasing; PB-vs-mirror bridge sentence in the mapping
paragraph; 'bespoke bar' lead-in dropped; Table 1 ragged-right columns.
Declined with reasons recorded: Lemma-4 sub-case itemization and
renaming the composition theorem (both reviewers' optional-only notes;
churn risk at the frozen gate outweighs gain).
Gate status by the reviewers' own words: Fable round 15 'nothing
blocks' x3 with full evidence discipline; GPT 'after the two
correctness fixes and the three layout fixes ... nothing blocks
submission on correctness or readability grounds' — all five applied
and render-verified. 0 overfull, suite 115 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator-ordered UX audit (full linear read + every page rendered and
visually inspected + both reviewers' 'visually clear' certifications
spot-checked). Scope: no theorem, proof, or scope sentence changed in
meaning.
BUGS FIXED (both missed by both round-12/13/14 reviewers):
- Deployment figure: leaf 11 was CLIPPED to 'clea' by the overlapping
1.3cm 'accumulator' box — box now standard width, label 'accum.'
Verified fixed by render.
- The sentence 'Leaf 12 attests the accumulator corpus at commit' was
split from its hash by a float/page break, stranding the bare commit
after the figure — now wrapped in samepage. Verified by render.
- 'signing- library' hyphenation artifact in §6.3.
READER AIDS (for adjacent-field experts; verifiability up, rigor
untouched):
- Notation summary table (12 rows) at the end of §4, right before the
security analysis that uses every symbol.
- NEW transport figure (now Fig. 2): the 6->8 instance with the opening
path (red), frontier values A,B (blue), consumed proof value (dashed),
kept siblings (orange), and the r0/P0 assembly inset — §5.4's five
pages previously had zero figures. Hand-verified by render;
referenced from the transport-algorithm paragraph.
- 'Games at a glance' table (game/adversary/secrets/wins-by/consequence)
after the §5.4 intro.
- One-sentence reading guide at the top of §5.4.
- 2->3 tie-in after the transport proof (the log's own transition as the
smallest growth case; seam subsection gains a label).
- 'assumption cone' defined at first use (§2.1).
DE-SEDIMENTATION (three review rounds of accreted hedges, reorganized
with all semantic content kept):
- §5.4 intro: one 14-line wall -> four short paragraphs (context /
two levels / non-interactivity), duplicated hardness sentence merged.
- HIST game: definition crisp, commentary moved to a parenthetical.
- Abstract: ~15% tighter (inventory numbers -> '61 human-reviewed
certificates over a single uninterpreted SHA-256 axiom'; run-on
split). All boundary/honesty sentences retained.
22 pages, 0 overfull, suite 115 green. Deployment figure renumbered
2->3 (no numeric figure cross-references existed).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-14 verdicts: the Claude reviewer CONCEDED its round-13 FORK
objection in writing ('I WAS WRONG', with the correct reasoning after
attempting the demanded counterexample) and passed everything
('nothing blocks x3') — but its 'chi genuinely encoded in the payload'
certification silently swapped pk out of the tuple, missing exactly
GPT's blocker 1. GPT verified the transport induction branch-by-branch
(sound) and found three real integration blockers, all independently
confirmed here before fixing:
- B1: chi contained pk and was claimed payload-encoded; the deployed
payload does NOT carry the key (it is an external verification
parameter) and the game fixed chi before KeyGen created pk. Now:
chi_enc = (log id, schema/type tags, hash-alg) is the encoded
context; chi = (chi_enc, pk) is set after KeyGen; all game texts
(syntax, injectivity lemma, HEAD, FORK/Ev) rescoped accordingly.
- B2: context scoping propagated to the three sites still stating the
cross-log-flawed form: Definition 2 clause (iii), Proposition 1
(statement + proof), and the Appendix A fork row — plus clause (i)
redefined as opening uniqueness under an authentic view (the
'position-bound' ambiguity), the App-A membership row aligned, and a
NEW App-A row for full-mirror recomputation (verify.py --all).
- B3: the security corollary no longer treats the epistemic
human-ignorance premise as a contradictable assumption. It is now
'Constructive security consequence': explicit feasible winner =>
explicitly given, equally feasible collision finder (stated costs);
HEAD/FORK => one EUF-CMA forgery, no loss; the human-ignorance
reading is an engineering judgment stated as such. Intro sentence
aligned.
Minor round-14 items adopted: kbelow citation corrected to the exact
corpus theorem kbelow_prefix_eq (Consistency.lean:48 — it EXISTS;
GPT's claim that no literally-named lemma exists was wrong, my memory
was right); payload-injectivity proof covers the timestamp string and
is scoped to the specified serializer; HIST chain re-termed
'head values, Merkle-level, authentication is HEAD's job'; transcript-
length cost sentence in Theorem 5; 'strong induction' clause;
DGHS-adaptation positioning sentence ('not a bespoke bar' — worded
'adapt', per GPT round 13's own caution against 'specialization').
21 pages, 0 overfull, suite 115 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reconciliation first: the two round-13 reviews CONTRADICT on FORK.
Opus (flagged mid-review as flipped, per operator): 'frame-resistance
unsound as stated' because payloads carry timestamps. GPT: 'the right
EUF-CMA form.' Independent re-derivation sides with GPT: a winning head
needs a VALID SIGNATURE on its never-queried exact payload bytes — a
forgery regardless of timestamp; Opus's no-forgery scenario never
produces the valid signature it presupposes, and its own fix paragraph
concedes the win condition already means exact-payload freshness. Its
real residue (the (n,r)-injectivity parenthetical was a red herring in
that proof) is adopted: the parenthetical is gone, injectivity is now
its own lemma where it belongs.
GPT findings, all verified then fixed:
- Theorem 5 formal error (CONFIRMED): the proof applied transport to
same-size transitions outside the lemma's n0<n1 hypothesis, and the
lemma's last line smuggled that case. Lemma restated for n0<=n1 with
the equal case explicit; HIST proof now case-splits (equal: Ext
forces equal roots, opening carries over; growth: transport).
- Prefix transport (CONFIRMED under-proved; Opus concurs): the frontier
narrative is replaced by a FULL induction over the ConsRec recursion,
with the verifier recursions displayed, the value-equality invariant
(rho = y) threaded exactly as the corpus's extractConsNode analysis
identified, explicit P0 assembly per branch, the no-mismatched-
stopping-points argument (shapes are integer-determined), and the
power-of-two split-stability step credited to the corpus's mechanized
kbelow lemma.
- FORK cross-log framing flaw (CONFIRMED): evidence predicate now
context-scoped — fixed chi = (log id, schema/type, hash-alg, pk)
declared once, encoded in every head; one key running two logs can no
longer be classified as equivocating. Prose corrected to
'issued-message attribution' (no more 'never equivocated' oracle
mismatch).
- HEAD-AUTH game added (CONFIRMED gap): outsider forging one ordinary
head reduces to EUF-CMA; G1's forgery leg is now discharged by an
actual game, closing the network-attacker hole.
- Two-level formalization (CONFIRMED): Definition 3 = collision-
extractable accountability (unconditional, explicit reductions with
stated costs); NEW security corollary = what human-ignorance CR +
EUF-CMA + correct key + fixed context then rule out. Extractability
no longer masquerades as hardness.
- Composition mapping made precise: G1 narrowed to authentic position
binding (HEAD + PB opening-uniqueness; full-list membership is a
system property of the published mirror, said so); G2 split into
syntactic pin rule vs semantic HIST content; monotone-extensions and
payload-injectivity as one-line lemmas; HIST game syntax lists C_i
and 0<=a<b<=k; Adv defined for the two keyed games; PB cost notes
retained intermediates; Rogaway bibitem gains the DOI (211-228
reconfirmed by GPT: Springer/DBLP vs the author's list-page typo).
21 pages, 0 overfull, suite 115 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New \S5.4 'Scheme-level games and a composition theorem' (operator
order: third attempt targets an IACR venue):
- Game PB (position binding): two accepting openings of different
leaves at one (m,n,r) -> explicit B_pb outputs a SHA-256 collision
in <= 2(ceil(log2 n)+1) hash evaluations (two-transcript top-down
comparison; 32-byte widths make argument pairs recoverable).
- Lemma (prefix transport): an accepted ConsRec transcript plus an
accepting opening at m<n0 under the NEW head yields a collision or
an assembled accepting opening under the OLD head (frontier
comparison + old-root spine assembly; degenerate power-of-two case
handled).
- Game HIST (local history binding): pin-rule chains + contradictory
openings at any two accepted heads -> collision, by transport
induction + PB. Supplies the multi-step closure at paper level.
- Game FORK: evidence completeness by construction; frame resistance
reduces to EUF-CMA. Win condition deliberately over canonical
PAYLOADS, not heads — a second signature on an already-signed
payload is not an EUF-CMA forgery (SUF/EUF trap caught in the
self-audit pass before integration).
- Policy separation as a deterministic lemma (per GPT B6's own
suggestion), formal Definition 3, and Theorem 7: the construction
is an accountable replay-distribution scheme.
- Fixed-function SHA-256 handled per Rogaway's human-ignorance
treatment (new citation, arXiv-API/DBLP/Springer-verified: VIETCRYPT,
LNCS 4341, pp. 211-228, 2006 — note Rogaway's own page carries a
221- typo): every hash statement is an explicit reduction, the
scheme-level continuation of the named-extractor discipline.
- Games are non-interactive BECAUSE the operator-adversary holds the
signing key (no secrets, no oracles) — stated in the section,
mirroring the deployment's non-interactive verification.
- Honesty anchored: scope remark + new coverage-table row (two-
transcript comparisons and prefix transport are paper-level, not
mechanized); Definition 2 re-badged informal with pointer; DGHS
two-transcript lineage credited in related work.
19 pages, 0 overfull, suite 115 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
All five GPT blockers, independently confirmed against source before
any edit, plus the real subset of the Opus findings:
- B1/M5: every strict-superset/strictly-more/larger-acceptance-set
claim (5 sites incl. two that wrap across source lines) replaced by
witnessed non-equivalence + pinned-family language; the Remark now
states explicitly that no global inclusion relation is claimed.
- B2: the optimistic-accountability/fraud-proof paragraph is REMOVED
(operator: bloat; GPT: technically wrong — consumers do not accept
by default, and a collision refutes the hash assumption rather than
attributing operator misconduct). The careful long-form analogy
stays in ltl-accumulator-verified/docs/optimistic-accountability.md.
- B3/M7: claim matrix — kernel-observation row split into operator-
CLAIMS (established) vs kernel-ACTUALLY-produced (not
cryptographically established); EUF-CMA/CR added where load-bearing.
- B4: artifact + Appendix C sentences now describe the upgraded
verifier (lean-transparency-log 52179bd: --all covers every
published receipt, binding fields required; 11-case adversarial
selftest GREEN).
- B5: pin-store sketch gains the equal-size/equal-root case via
whole-tree binding.
- M1 detached-signature honesty; M2 abstract axiom-name-sets +
compared-views narrowing; M3 kernel time -> end-to-end replay time;
M4+F4 consumers -> 'Consumer prototypes and version exactness'
(implemented prototype, informal check, explicit non-evaluation
disclaimer); M6 Appendix C listing fails closed on short proofs
(take() guard, verified empirically); M8-partial two alternatives-
table cells + design-taxonomy prose paragraph (also closes Opus F1
orphaned header); M9/F5 single experience report; M10 policy-
separation row in the coverage table; M11 27-line portability
number restored; F2 abstract 'via differential testing'; F3 linking
clause after the consistency theorem; Option-valued notation note
(both reviewers); GPT terminology sentence after Definition 2.
17 pages, 0 overfull, dead-phrase sweep clean. Suite 115 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Naming a specific third-party system on the strength of a family-level
dependency observation, with no engagement and no receipt code, reads
as arbitrary and could imply a relationship that does not exist. The
sentence's actual content — attestations are version-exact; a
family-level match confers nothing — needs no name and keeps it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The reinvention outline and the standing paper queue carried five items
that the round-11 draft lost: (1) retrievability decay (leaves whose
pinned commits cease to be distributed decay to historical record —
author Q&A 2026-07-10, outline explicitly kept it); (2) the
extractor-vs-bare-existential sentence (over a fixed-width hash 'a
collision exists' is vacuous by counting; the corpus's named extractors
+ pinned non-vacuity guards are the content — the S3.5 lesson);
(3) the one-implementation crate parenthetical (first-page misread
signal); (4) issued-at spacing corroboration of the ~30-minute replay
figure; (5) the SHA-1-vs-SHA-256 binding honesty clause. 16 pages,
0 overfull.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Executes the approved reinvention outline, using the round-11 GPT-5.6
draft as base material; the operator remains the author of record and
this pass is the authorial fact-check + completion of that draft. New
title: 'Accountable Distribution of Machine-Checked Correctness
Evidence: A Transparency Model and the Lean Transparency Log' (16 pp).
Old 19-page system report archived byte-identical as v0.2
(paper/ltl-v0.2.{tex,pdf}, served at /paper/v0.2; v0.1 unchanged).
Every factual claim in the draft was verified against the estate before
adoption: 222 inventoried constants + 61 reviewed cones (README:36),
all four fidelity counts, the gap-14 lied-size witness reproduced
empirically (deployed verify_consistency(1,3,R2,R3,P)=True while the
recursive model rejects; honest 2->3 True/True), all four apex theorem
names greped from the dalek repo, the entry-13 scope block now quoted
VERBATIM (was silently trimmed), the new klaus2026 citation confirmed
real via the arXiv API (author order corrected to Klaus, Conejero,
Tolmach), remaining 20 bibitems byte-identical to the F10-verified set.
Author corrections beyond the draft: 'opaque SHA-256 function' ->
uninterpreted/boundary AXIOM (matches axiom sha256 : List UInt8 -> Hash);
STH field list now matches the deployed head (adds type tag); lied-size
mechanism sentence from the gap ledger; six-published-heads (sizes 8-13)
mirror honesty; consumers subsection (warden + Swiss Post family-level
negative) per outline item 7; optimistic-accountability related-work
paragraph per outline item 8; fifteen-gap ledger pointer per outline
item 9; verify.py fail-closed tie-ins in artifact availability and
appendix C; wired the six uncited bibitems (lean4, pnueli, eddsa,
rfc8032, edwards+twisted, easycrypt); certificate listing gains the
deployed 'diagnostics' field. Build: 16 pages, 0 overfull, 0 undefined.
web.py: /paper/v0.2 route + loader. webdocs: paper card rewritten for
v0.3 with both archived versions linked. Suite 115 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- §5/N1: the '16/16 proven' pill was hardcoded — false for the
accumulator (61 certs). Now computed proven/total from each
component's newest leaf (forks show 16/16, accumulator 61/61).
- §2: 'the only thing you take on trust' → 'sole cryptographic identity
anchor; truth rests on each leaf's stated assumptions' (both the top
card and the download table).
- §3: 'the signature vouches for the code that produced it' → the signed
tree CONTAINS an attestation of the reported signing source; execution
provenance is reported, not proven; provenance fields are unsigned
metadata.
- §9: 'irrevocably part of the log every other customer sees' → this
signed head commits it to THIS view; comparison exposes split views.
- §4.4: witness 'never equivocated' → a retained view that can EXPOSE a
conflicting head; one clone cannot prove no split view.
- §10: 'the git hash is the content hash' → the commit identifies the
committed git tree, not deps/toolchain/artifacts.
- §6: live-site 'twelve-leaf deployment' blurb → 'live deployment'.
Suite 115 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deployed instance now 13 leaves; entry 13 attests the log's own
accumulator machinery; the producer emits a per-leaf scope block.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Responds to the converged positioning diagnosis (GPT-5.6 post-mortem +
round-6 reviewer): inverted structure — trust-decomposition model
first, design-space comparison section, LTL as instantiation, gap
14/15 presented as a located-and-fenced result, entry 13 as Exhibit A
(the only-this-paper claim; rewrite finalizes AFTER the append so the
abstract cites the live leaf). Lists what moves out, venue sequencing
(arXiv then CPP/ITP/SCORED/RWC), and the success criterion (the
thought-experiment polarity flip). Old ltl.tex remains hosted as the
system report; queued wording fixes are absorbed by the rewrite.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Its last two callers vanished in the round-6 hardening (parse anchors
on the exact phrase via regex; classification is membership-based).
Dead code in an audited producer invites misreading. Suite 115.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Found by the entry-13 12->13 rehearsal: build_attestation emitted
subject/environment/replay/certificates but NO scope — the profile's
guarantees/exclusions/deployment_constraints (which carry a repo's
known_status scoped-claim wording and known_exclusions) reached only
the claim card, never the published leaf. So the round-6 requirement
that entry 13's LEAF carry its scoped attestation text was unmet by the
code; a reviewer who checked the claim card saw the wording that the
leaf did not contain. Added a 'scope' block
(guarantees/exclusions/deployment_constraints) to the leaf; pure text,
safe to publish, validator is additive. Two provider tests assert the
block exists and that a repo's known_status/known_exclusions reach it.
Suite 115 passed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
R6-B1 (Claude, executed end-to-end): provenness was decided by a
WHOLE-OUTPUT 'no axioms' sentence, so an axiom-free certificate whose
line was entirely absent still scored proven+clean ([]==[]). The
reviewer drove a doctored 60-line output through the real gate and got
61/61 with domsep never audited. Classification is now extracted into
classify_certificates(): proven iff the certificate's OWN anchor was
parsed (axiom-free anchors populate []); absent certs are
unknown/failed + not_checked — never clean. This also fail-closes the
typo'd-future-cert case (R6-C2).
GPT §6: parse_axiom_output is now RECORD-scoped — anchors delimit
records, a cone bracket is accepted only inside its own record, missing
or truncated brackets yield MISSING (fail closed) instead of borrowing
the next certificate's bracket, and cones may wrap arbitrarily (the
old fixed 16-line window was a latent overflow for the 11-axiom
ed25519 apex cones on this estate). Anchor names are captured between
the exact quotes Lean prints.
Six new regression tests (absent-axiom-free-not-clean, missing-bracket
no-steal, truncated cone, >16-line wrap, duplicate anchor, interleaved
diagnostics). Suite: 114 passed / 0 failed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rehearsed end-to-end 2026-07-16 (throwaway key + throwaway log):
compile via the corpus's lean-guard, 61/61 certificates proven with
byte-exact cones (post parser fix 34a0457), append, publish,
witness-audit ok. kind merkle_accumulator uses the generic profile —
everything comes from this entry: the 61 fully-qualified certificates
with per-certificate cones (generated from the corpus's CONES table),
the nine Proofs.* axiom_imports (required — without them the generated
audit file has no imports and lean-guard rejects it), and known_status
carrying the REQUIRED scoped attestation wording (runbook B2 gate /
round-4 GPT §11): the mechanized model is verified; deployed
consistency correspondence relies on the unmechanized authentic-pair
invariant (KNOWN-GAPS 14/15).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Found by the entry-13 rehearsal (the accumulator corpus is the first
subject with axiom-free certificates — every fork certificate carries
at least the boundary axiom, so this path was never exercised):
- an axiom-free certificate ('X' does not depend on any axioms) was
parsed by opening a 16-line window and taking the first bracket in
it — which belongs to the NEXT certificate. domsep/Hash/
instDecidableEqHash/take_append_drop were reported with their
neighbors' cones and flagged dirty.
- certificate names were matched as bare substrings, so 'Foo' could
anchor on the line for 'Foo_bar'. Now anchored on the exact quoted
name Lean prints.
The no-axioms decision is now made on the anchor line itself, before
any window. Two regression tests added (steal-next-cone, exact-name);
suite 108 passed / 0 failed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
All six originated from the author's own adversarial read-through:
1. SS9: retrievability decay — leaves whose pinned commits are no longer
distributed (0-7 post-rewrite) decay to historical record.
2. SS4.3: why-a-tree — per-item signatures cannot evidence deletion,
expose forks, or provide pinnable state; dishonesty-evidence, not
scale, is the motivation.
3. SS1: curve/signature crate parenthetical (one implementation).
4. SS8: ~1,800s/fork corroborated by inter-leaf issued_at spacing
(within-run gaps 29m35s-30m40s).
5. SS5.1: git commit ids are hardened SHA-1 — said before a referee
says it.
6. App A box fidelity: logical-vs-canonical order declared; ellipsis
markers inside cert objects and at attestation level (covers
diagnostics + inner schema_version); '(14 more)' -> '(14
certificates elided)'.
Visual inspection: all changed pages (1,5,6,13,15,16,17) plus spill
pages 18-19 read with own eyes; p.19 is a light final page (App D
table), accepted over spacing tricks. 106 tests green, accumulator
untouched. Page-count refs updated (webdocs, llms.txt).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Read all 18 rendered pages with own eyes (per author order: never trust
tex->pdf as a given). Found: this portable TeX install's format ships a
broken righthyphenmin (verified: \showhyphens{its} -> 'it-s'), which
produced 'a receipt for a leaf is it-/s index' on p.7. Fixed globally
(\lefthyphenmin=2 \righthyphenmin=3); document-wide rescan shows zero
short-tail breaks. Everything else verified as intended: title block,
narrowed abstract, T1-T4 with x=0 note, Def 1, G1-G3, honest-width 4.4,
ConsRec display, frontier Lemma 2, Thm 2/3, claim matrix (auto-numbered
Table 1, refs consistent), exact 8|4 Figure 1, forks Table 2 caption,
acknowledgments both assistants, all 20 refs w/ pages, App A verbatim
values, App B code block, App C boundary order, App D namespace note.
18 pages, 106 tests green, accumulator untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Acknowledgments now disclose BOTH assistants: GPT (OpenAI) provided an
adversarial review that shaped the manuscript (it did not develop
corpora/tooling - the acknowledgment stays literally true). The .tex
header already credited Review B publicly; the ack now matches.
- ...signed_tree_head.v1 elision replaced with the real type string
pacta.transparency.signed_tree_head.v1 (matches the live head).
- G2: the public-mirror escape hatch marked witness-dependent (SS9
cross-ref) - closes the loop for a hostile reader.
18 pages, 106 tests green, accumulator untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Review A (second Fable instance, delivered via USB, findings re-verified
by me against the tex before adoption; its frontier lemma re-derived from
scratch before applying):
- THE REAL FIX: Lemma 2's hash-fold definition did not cover its own two
uses (Root recomputes only along the leaf's root path; ConsRec bottoms
out at the [0,n0) decomposition and consumes the pinned root, which the
old Steps 1-2 never pinned - incl. the degenerate case where the first
component IS the pinned root alone). Now: folds shaped by a connected
sub-tree S containing the root, children outside S consumed as opaque
inputs, conclusion pins emitted values AND all consumed inputs; Thm 2
names its S; Thm 3 pins the consumed anchor and handles the degenerate
case; Lemma 1's role stated honestly.
- dangling R4/R5 taxonomy labels removed; G3/Prop 2 statements now match
their own veto-proof (deny-only, everywhere); Table 1 caption counts
boundary+standard-three; r1 defined as raw signature bytes (T1's whole
point); Contribution 4 'embedded in every signature' -> 'published
alongside'; Figure 1 redrawn in the exact RFC 9162 shape for n=12;
Solana error-type nit; App D namespace elision noted.
Review B (GPT-5.6, positions defended 2026-07-10, concessions adopted):
- abstract + G2 narrowed to what Prop 1 proves (same-size evidence +
monotonicity), unequal-size split views routed through the public leaf
mirror; residual-trust sentence stated at honest width (checkout, deps,
binding, parsing in the trusted observation pipeline); freshness
declared an availability policy (freeze attacks not prevented);
self-reference verb 'ensures' -> 'enforces and records' + signature
reveals nothing about the producing program; novelty softened to
'we are unaware of'; 25-line/150-line accounting in one breath;
missing-oracle-axiom = refuse-to-classify drift (keeping the oracle
argument); mechanization tone softened; head-encoding reality
documented (versioned canonical JSON w/ log id - system was ahead of
the paper); NEW claim-matrix table (Table 2) decomposing every consumer
conclusion into mechanism + residual assumption, incl. two deliberate
not-established rows.
Open questions from Review A resolved: black_box 27 lines are per-lemma
trusted-base bookkeeping (no published cone contains black_box -
verified); T4 x=0 edge case now stated precisely (roots coincide, set
sign bit rejected per RFC 8032, covered by the iff over extracted code;
Lean sqrt_core handles x=0 explicitly); Cheval pages (DBLP-verified)
restored alongside Review A's DOI.
18 pages, 106 tests green, accumulator untouched (12 leaves).
webdocs/llms.txt page counts updated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The editor-correspondence kit does not belong in the public artifact repo.
Path gitignored to prevent re-adding. History purge follows.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two Fable-5 inventory agents cross-checked every empirical claim in the
paper against code/deployed log, and every external pointer against the
live internet. Fixes on both sides:
CODE (system brought up to the paper's claims):
- SECURITY: pin-store mutation (incl. permanent poisoning) was reachable
via receipts whose head signature FAILED verification in two of three
consumer paths (attestation.py, cli.py) - an unauthenticated forged
head at the pinned size could poison a consumer's pin forever and
pollute the equivocation-evidence pair with an unverifiable head,
contradicting SS5.4's 'validly signed' precondition and Prop 1.
Both paths now gate the store on a verified Ed25519 head signature
(logclient.py already did). Regression test added.
- Prop 2 made literally true: _normalize_certificate now derives the
cleanliness verdict purely from (observed cone, local allowed set) in
EVERY branch; the operator's axiom_status label is never copied (was
passed through for non-proven certs), missing cone => unverifiable
always. Labels can deny, never grant. Test added.
- webdocs: '/v1/sth-history: every head ever signed' -> 'the published
head history'.
PAPER (claims brought down to reality):
- 'every head ever signed' -> the signed head history since publication
began (heads for sizes 1-7 predate the mirror and were not retained).
- Run-3 bullet: 'independently checkable by diffing the two commit
trees' was no longer reproducible (pre-rewrite objects discarded);
now states the log-internal corroboration (identical cert lists and
cones across leaves 4-7 vs 8-11) and that tree diffs are not public.
- Appendix A leaf block now actually verbatim: scheme
openssl-ed25519, verified_backend serial/u64, real Lean version
(4.30.0-rc2) instead of 4.x.y placeholder, leaf's actual axiom order
(finalize/new/update), machine_protection note quoted, elisions
marked; preamble wording matches.
- Appendix C upstream boundary reordered to check.sh's verbatim order.
- '27 lines - all annotation' -> honest description (axiom-list entries
+ operation reordering from one fork's black_box barrier).
- Prop 2 proof + App A: status label consulted only negatively.
- SS7: provenance fields noted as outside the signed payload; consumer
chain relies on none of them.
- Bibliography: all 20 entries verified against DBLP/RFC-editor - zero
errors; added missing page numbers to 6 entries; thebibliography
width 19->20. All URLs verified public; no PlanetMacro leakage.
17 pages, 106 tests green, accumulator untouched (tree_size 12).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adversarial re-read of the security section found three exposition gaps
(no math errors, but the kind a referee pounces on), all fixed:
- Lemma 2 (Root binding): Theorem 3 Step 1 asserted 'every proof node
consumed is genuine', but the lemma's STATED conclusion only mentioned
values F emits, not siblings F consumes. Strengthened case (ii) to pin
the consumed siblings explicitly (it follows from argument-pair
coincidence, now stated, not just proved).
- Theorem 3 Step 3: 'hash-fold over itself' named the wrong object — for
Lemma 2, T_{D1[0:n0]} must be a hash-fold over T_{D0}; justified by
equal size => identical shape, leaf inputs = D1[0:n0].
- §7: 'self-referential without being circular' was asserted; now argued
via the explicit acyclic verification order (pin key -> check sig ->
verify inclusion by hashes -> optionally rebuild+recheck source), no
step consuming its own output.
17 pages, refs resolve, 104 tests green (verifier defs untouched).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Re-auditing the prior (Opus-produced) depth pass adversarially found and
fixed three genuine issues:
1. OVERCLAIM (serious): §5.3 said the consistency verifier was
differential-tested 'on all (n0,n1) with n1<=256' but the script only
SAMPLED sizes (5,508 cases). Ran the genuinely exhaustive test — all
1<=n0<=n1<=256, honest + 4 mutations — 164,224 invocations, and the
inclusion verifier likewise (164,479). Paper now states the true scope
and counts; both are pinned in a new CI test (test_paper_verifiers.py,
104 tests) so the numbers cannot rot.
2. PROOF IMPRECISION: Lemma 2 (Root binding) was applied to ConsRec's
first component, which PASSES THROUGH (no hnode) at some levels and so
is not the hash-fold the lemma needs. Reworked: Lemma 2 now defined
over 'hash-folds' only; Theorem 3 restructured into 3 clean steps that
put only the full-hashing second component through the lemma, then
argue algebraically + one honest-tree collision. Also hoisted Lemma 2
above Theorem 2 and made Theorem 2 invoke it (was inlined), so the
'two theorems share the lemma' remark is now true; deduped the remark.
3. MISLABELED TABLE: Table 1's 'files vs upstream' column actually held
line-diffs against different baselines. Dropped it for clean comparable
columns (files / apex axioms / SHA-512 shape); the diff story stays in
the portability paragraph where each baseline is named.
17 pages, all refs resolve, 104 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Not size for its own sake; each addition is a definition, proof, figure,
or measurement the genre expects and the rejection implied:
- §2: the signature apex given real depth — the four tiers stated as an
explicit lifting ladder T1-T4 (byte apex -> canonical half-lift ->
injectivity/point-eq via non-square d -> constructive full lift), each
naming the one new mathematical fact; the corpus's actual achievement,
previously an appendix bullet list
- §4: scheme-syntax Definition (KeyGen/Append/ProveIncl/VerifyIncl/
ProveCons/VerifyCons/Verdict) in DGHS style, so the goals name real
algorithms; new subsection making the observation-not-verdict /
requirements-card idea explicit (the system's distinguishing claim)
- §5.3: the consistency verifier DEFINED (recursive ConsRec form),
closing the gap where Theorem 3 previously reasoned about an
undefined verifier — differential-tested == deployed RFC verifier on
5508 cases (honest + 4 mutation classes, n<=256)
- §6: Theorem 3 now a FULL proof (was a sketch), factored through a
shared Lemma 2 (Root binding) that both soundness theorems use
- §8: Figure 1 (the twelve-leaf tree w/ grey failure leaves + 3-run
braces) reinstated and improved; Table 1 (per-fork files/boundary/
diff/hash-shape) replacing a prose paragraph
- App D slimmed to the verbatim Lean theorem-name mapping (no longer
duplicates §2)
Both recursive verifiers regression-tested against deployed code. 102
tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Removal (user decision): paper/ltl-v0.0.{tex,pdf} deleted; /paper/v0.0
route removed; test now asserts 404 for it; /paper/v0.1 stays for
citability and is linked from the docs card.
Audit findings from re-reviewing the last session's work, all fixed:
- Appendix A claimed 'all other fields are verbatim' over elided
placeholder values - reworded to state exactly what is elided vs
verbatim (a paper about exactness cannot say verbatim over an ellipsis)
- LTL docs paper card still described the 4-page v1 (old title, old
scope) - now the revised title, 14 pages, proofs summary, v0.1 link
- llms.txt paper line updated to the revised title
- paper/eprint-submission.md rewritten as the RESUBMISSION kit: new
title/abstract, message-to-editors change note, form-not-email
guidance, author-only checklist
102 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Paper:
- v2 (12->14pp: appendices) promoted to paper/ltl.tex; v1 kept as
ltl-v0.1.tex, pseudonymous variant as ltl-v0.0.tex (identity-clean)
- filled from verified artifacts: App C (3 verbatim per-fork boundaries:
dalek 11 / hash3 8 / anza 7), App D (real 4-tier ladder + parser
hypotheses; the other agent's 'Tier 3/4' guess corrected), App A (real
leaf 8 structure); §8 now twelve leaves / three runs incl. the
history-rewrite absorption (a live G2 demonstration); §7 self-check
index 4->8; Limitations count fixed; two overfull math displays fixed
- title/author/ORCID unchanged from the revision
Hosting: web.py serves /paper (current), /paper/v0.1 (prior named),
/paper/v0.0 (pseudonymous) - older versions unlisted in the endpoint
index; test added.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Makes the paper's pin-store safety proposition true in the deployed code:
- the full signed STH is retained at pin and at each advance (not just
size+root), so on equivocation both conflicting heads are transferable,
signature-verifiable evidence;
- any equivocation (same-size root mismatch, or a consistency anchor
disagreeing with the pin) persists poisoned=true with both signed
heads and refuses ALL further operations for that log, restart-proof
and independent of the update flag;
- rollback unchanged. 102 tests (was 100): poison persistence, evidence
transferability, full-head retention.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The lecture-11 framing where customers actually land: the allowed-axioms
list as a card the customer owns and can rewrite; verdicts re-derived
against THEIR copy; stricter card => itemized gap => relax / walk away /
grow the supply. Links to lecture 11 for the executable walk-through.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Consolidates the consumer-side trust framing that was scattered across
notebooks 05/06b and WALLET.md into one on-ramp: the allowed-axioms list
as a requirements card you own and can write yourself; measurement vs
publication vs judgment (operator/log/you); the three honest outcomes
when your card is stricter than the supply (relax itemized / walk away /
grow the supply). Executable: a self-written card is shown to equal the
real APEX_BOUNDARIES cone exactly (supply == wish: True), and a strict
no-oracle card is REFUSED with the real SHA-512/wire gap itemized.
Registered in course map + notebook test; 101 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The bundled offline-showcase evidence now pins the current repository
commits (dalek 33fb8bb, anza 25b73f1, risc0 d3318b6, betrusted 7b9ef53)
and their fresh receipts (log tree_size 12). R4 gate verified to open on
it; 100 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Generic mechanism: bare-name PDFs placed in the log directory's site/
folder are served by name, checked LAST in the route chain (can never
shadow an API route), traversal-safe, noindex, and deliberately absent
from the endpoint index and the docs page - the operator decides who
receives a link. Tested: serve, unlisted-in-404, traversal rejected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The LTL does not mechanize cryptographic security proofs (EasyCrypt and
relatives own that bridge, now cited); it bridges the adjacent, mostly
empty gap - type-theory-certified artifacts have no distribution
infrastructure, and cryptographic transparency infrastructure has never
carried kernel-checked mathematics. Fit maintained at 4 pages (bottom
margin 1.95cm, bibliography scriptsize); pages 1 and 4 visually
inspected; 18 references.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The provider public key is the one thing a consumer takes on trust;
hiding it behind /log-public-key inverted the page's priorities. New
'The trust anchor - pin this key' section at the top of the docs page
shows the PEM in full with its SHA-256 fingerprint, the mirror-compare
instruction, and the raw endpoint for scripts. Honest 'missing' card if
a deployment lacks the key. Test asserts the page renders the key.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Socratic audit findings, all verified against artifacts:
- 'zero lines between structurally identical forks' was FALSE: risc0 vs
betrusted differ by 27 lines (all annotation, documenting the risc0
fork's black_box trusted-base entry). Corrected to the true number.
- '~64 Lean files per fork' over-rounded anza's 58. Now '58-64'.
- completeness parenthetical now states both hypotheses (a=-1 square, d
non-square), not just d.
- 'key published in two independent locations' was ASPIRATIONAL: the
site served only a fingerprint. New /log-public-key endpoint serves
the key bytes; docs-page artifact-1 row links both copies; test added.
Verified exactly and kept: 215-line parser diff (FromBytesSpec), 121-line
signature-glue diff (SigApexSpec), byte-identical x4 math files incl. the
carry-telescope file, 11-axiom upstream boundary, 16 certs/leaf, 153-line
mirror verifier, leaf fields (toolchain + machine_protection), all 17 refs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Chosen from the shortlist; states the two-traditions loop directly and
drops the jargon. PDF rebuilt (4 pages), page 1 visually inspected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Title: 'LTL: Lean Transparency Log'; subtitle now 'Distributing
Machine-Checked Proof Evidence through a Recursively Self-Certifying
Merkle Log' (the log carries the certificates of the code that signs
the log - recursion named, marketing dropped)
- Author: Olaf Horvath, contact Olaf.Horvath@zkdefi.org, single URL
ltl.zkdefi.org (redundant zkdefi.org line removed)
- PDF rebuilt (4 pages), page 1 visually inspected
- title echoes updated: llms.txt, LTL docs-page paper card
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Correctness:
- ledger: single-flight fcntl lock over read-modify-append + fsync. Two
concurrent writers previously could fork the hash chain (read same tail,
same prev_hash). New test races 8 threads x6 appends; chain stays intact
with contiguous indices.
- small-order list: the order-8 encodings were hand-typed and unverifiable
and diverged from the canonical libsodium blocklist. A BOGUS entry is the
only dangerous direction (it down-grades a real tamper to a note, skipping
the latch), so the list is now the certain-low-order set only (y in
{0,1,-1}, reduced/non-reduced, both sign bits); order-8 edges escalate to
tamper until a derived list lands. Fail-safe asymmetry documented + tested.
- freshness: removed a tautological .
Non-functional:
- quorum members now run concurrently (ThreadPoolExecutor): a verify costs
one member's latency, not the sum (~17ms for 4 members, live).
- Wallet.quorum() memoized per state_dir: binary swap-detection hashes run
once at assembly, not on every verify; documented rationale.
85 tests green; live 4-fork wallet re-verified end-to-end.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Self-contained dark-theme product page: the one idea, the trust-posture
asymmetry, the firewall diagram, the four deployment profiles, and the
non-claims. Also published as an artifact.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pacta wallet init/status/card/verify-ledger and the stdio MCP server
all confirmed working end-to-end against the four-fork R4 wallet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
