Per the 7-reader didactic panel and BOOK-OVERHAUL-PLAN.md:
- front matter: box legend demoted below a lived example (the aha box
becomes its own legend entry)
- ch04: open on the stake (proof the size of a compiler), new section
'When you get stuck --- and you will' promoting the debugging session,
checkpoint now carries the omega cliffhanger forward
- ch06: open on the dare (invert 19 mod a 77-digit prime, two-digit
numbers only), machine-referee #eval after the Euclid box, checkpoint
distills the constant-time trade into one quotable sentence
- ch10: cold-open on the 12 GB crash, spec vocabulary re-armed at the
summit statement, falsification tryit after the 16p box (the -151
#eval), wall dispatch tied to the cold open, closing paragraph places
the certificate in the live log
- ch12: opening pyramid figure now carries question marks resolved
layer by layer through the chapter (suspense instead of spoiler),
kernel-wall rendered as a scene, 'Where you come in' promoted to its
own subsection, false 'closing chapter' removed
- appendix-toolkit: opens in the design-review room, Drill 7b (parity
argument), street assignment close
- appendix-walkthroughs: opens at the reader's low point, one-hole-one-
paragraph contract, counts replaced by 'trust the folder'
- appendix-repo-tour: active three-promise opener, sabotage-the-button
tryit, final tour stop at the transparency log
Build verified: tectonic clean, 118 pages, zero unresolved refs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
From the 7-reader didactic audit (control/BOOK-OVERHAUL-PLAN.md). The two
highest-leverage moves per the cold-open reader and the panel's most-repeated
finding.
MOVE 1 — the reader touches the real thing in minute one. The panel's single
loudest note: a book that teaches "demand verification" gave the reader
nothing to verify for twelve chapters. Now: the title page names
ltl.zkdefi.org (19 entries, one post-quantum, "verify every entry yourself by
the last chapter"); the preface opens on that page instead of a generic power
claim; ch1 gains a try-it box after the pyramid pointing at entries 13-16 and
18. And ch7's broken promise is honored — it invited "check one leaf" while
never printing the 71-digit Q; the exact Q from P25519.lean is now on the
page, no hidden digits (render-verified against the repo).
MOVE 2 — ch1 cold open. Per the cold reader who hooked at line 13 and wobbled
by line 31: the first worked box (a log10 re-derivation of a punch the prose
already landed) collapses to four lines, the mechanics pushed to Exercise 1.1
— getting the reader ~30 lines sooner to the headroom box, the genuinely novel
bit. The vague "In 2014, researchers…" opener becomes the actual bug: a
two-line diff captioned as the entire defect, anchored to the real Fiat-Crypto
S&P 2019 lineage (no fabricated CVE). Competitor roll-call → footnote.
Syllabus roadmap → a second-person promise ("by Chapter 7 you will have handed
a kernel a certificate…"). "Why Lean" vendor bullets → reader-inheritance
voice ("you start on a million lines of proved mathematics").
Builds here: tectonic, 116 pages, zero errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
No root available here, so the toolchain is tectonic (single user-space
binary, packages fetched on demand). The preamble unicode block is now
dual-engine: pdfTeX keeps its DeclareUnicodeCharacter list, XeTeX gets a
newunicodechar twin generated from the same 37 mappings — both branches
must stay green (Mac pdflatex, Ubuntu tectonic). build.sh is the one
command. The committed PDF is current for the first time since July 6:
116 pages, ch13 + the live-log section finally in print.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Measured before writing: the book made ZERO references to the transparency
log, the live site, leaves, receipts, verify.py, or anything post-quantum —
two incidental uses of the word "accumulator" were the entire overlap with
the estate's flagship artifact. A book that teaches "who checks the checker"
never mentioned that a live log practicing every one of its principles is
publicly checkable.
New closing section of ch13, "Go and touch the real thing": what a leaf is in
the chapter's own vocabulary; the fifteen-minute exercise (clone the mirror,
verify.py --all, pin both trust anchors two independent ways, read leaf 18 in
full); the map from the log's nineteen leaves onto the book's chapters
(leaves 13-16 = the pyramid at 44 certificates with ch11's boundary-exact
apex cones in production; leaf 17 = ch13 made literal, the log carrying
proofs of its own Merkle machinery; leaf 18 = the first post-quantum subject,
FIPS 205 verify path); and the two boundaries a reader must hold — verify
proven / signing never, for both algorithms, and the frozen paper as an
honestly-aged snapshot contained byte-identical inside today's history.
Root cause of the staleness, named: the book has no button. Every other doc
surface in the estate is gated or audited; the book froze as a July-6
deliverable plus one chapter. Until it grows a gate, estate doc audits are
its only clock (last: 2026-08-08).
README: ch13 entry expanded accordingly. PDF still awaits a LaTeX host.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Nine parallel readers audited every doc against measured ground truth; every
finding was re-verified against the file before any edit, and the sweep fixed
by PROPERTY, not by flag — wording the readers caught in one repo was hunted
in all siblings (the two-button README sentence existed in all four forks,
not the three flagged; likewise the cone-overclaim in TRUSTED-BASE item 1).
This repo: see the diff. Records were not rewritten; clarifications are
dated. Doc-only except where noted in the estate summary; every gated doc
change was followed by a green button run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The book taught act one (getting a kernel to accept a proof) across twelve
chapters and never taught act two: the protocol that makes a green light mean
something to someone who was not present. ch11 armed the reader to interrogate a
CERTIFICATE and left the script that interrogates certificates — software the
author wrote, verified by nothing — entirely unexamined. That was the gap eight
rounds of external review found in the companion projects, and it is a didactic
failure of this book too.
ch13 teaches it from the war stories: the two acts and why act one is the easy
one (eleven theorems in two days, never disputed; eight review rounds and
eighteen defect classes to make the button over them credible); the single shape
every failure had (something load-bearing sat outside the binding), with the
demonstrated exploits including ALL GREEN over a repository proving False, a
certificate reduced to 'the loop equals the loop' with every fingerprint
byte-identical, and a stubbed compiler wrapper going green in 3.6 seconds over
destroyed proofs; completeness of binding and its four rules (derive the
population, fail closed on absence, exact not subset, a stranger must re-derive);
and the meta-defect of assertions that pass for the wrong reason, including the
tautological assert that appeared twice — the second time inside its own repair.
Closes with the habit to carry: ask both questions, and invite someone to attack
your button early, because none of the eighteen was found by the author.
ch11 now forward-references it at the point where the old blind spot sat.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The owner's requirement, now the book's explicit contract (new "ratchet
rule" box in chapter 1): every load-bearing idea is worked at least
twice - once at napkin scale (mod 13, inverses by scanning) and once at
REAL scale, the actual 77-digit Ed25519 constants printed in full with
no digits hidden and no artificial zeros; where raw size genuinely
exceeds paper (a 77-digit square root), the book says so and teaches
witness-auditing instead of pretending.
Socratic audit result: chapters 1-11 already honor the rule (verified
rung by rung - e.g. ch6 pairs the Z/12 clock with 19^-1 mod the real p;
ch7 pairs Pratt-for-97 with costing the real certificate; ch8 runs the
extracted model at the real envelope edge). The gaps were ch12's three
summit rungs, which had NO numeric examples at all. Filled:
- Group law: "running the addition law by hand - napkin curve, then the
real one". Doubling (2,4)->(10,11) mod 13 in full; then the real base
point with x1, y1 printed in 5-digit groups, the first machine step
certified as x1*y1 = q*p + u with the 77-digit witness q printed, and
the student auditing it by casting out nines AND elevens (both clocks
close: 3=3, 1=1). Lands on the real 2B coordinates.
- Scalars: the cycle felt on the napkin curve first (order 16, so
21P = 5P) before the real prime ell.
- Apex: "decompression, run twice". Encode/decode (10,11) as "(11,
even)" mod 13 - x^2 = 3/9 = 9, roots {3,10}, parity picks 10; then
the real compressed base point: all 32 bytes printed (58 66...66),
byte 31 = 0x66 sign-bit read, y_B printed in full, and the
no-shortcuts full-size hand verification 5*y_B - 4 = 4*p, both
78-digit sides printed for digit-by-digit comparison. The square
root honestly declared machine territory, with the witness-checked
certificate named.
- New paper exercise 12.4 (+pathway/solution): encode & decompress
3P = (6,10) solo - the wrong root lands on -3P, one bit doing real
cryptographic work.
Every printed constant machine-verified before typesetting (base point
on-curve, q*p+u exact, 5y-4 = 4p exact, 2B on-curve, toy order 16).
PDF rebuilt: 109 pages, zero errors. Honesty ledger records the
revision.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The companion repos completed their signature apex (phases 1+2: four
button-enforced tiers up to "accept <=> decompress(R) = [k](-A)+[s]B as
points") and the scalar layer long ago crossed the kernel frontier - but
the book still taught the pre-campaign state, including one real
inaccuracy of the class coherence pass 3 purged from the repo READMEs:
ch12's apex section and audit-drill solution described the COFACTORED
equation (8sB = 8R + 8kA) with SIMD backends in the trusted base -
neither matches the proven certificates (canonical-R byte equality,
serial path pinned and proven, SHA-512 an oracle with NO assumed
properties).
Fixed:
- ch12: pyramid status diagram (scalar + signature rows now "done"),
the scalar-frontier paragraph (the wall was crossed, and how), the
apex section (future tense -> the proven four-tier statement, honest
trusted base), the "extend the pyramid" bullet (scalar -> pasta curve
layer; CONTRIBUTING files never existed - now points at the control
repo's METHOD/TIERS), exercise 12.2(c) solution (which lineage the
cofactored robustness belongs to), exercise 12.3 + solution (audit
the REAL certificate).
- ch01: framing diagram states the equation actually proven
(sB = R + kA from raw bytes, not the cofactored form).
- glossary: Cofactor entry says which verifiers check which equation.
- ch11: the companion repos' posture is stronger than the ideal-hash
example - no hash properties assumed at all, backend question
eliminated rather than assumed.
- ch08: extraction notes (one merged universe; extract-scalar.sh was
retired in coherence pass 3; SIMD scoped out, not assumed).
- repo tour appendix: floor plan, reading order (item 5 now tours the
apex capstone), Phase 3b described.
- README: companion table rows say "the complete pyramid" with the
four-tier apex; honesty ledger records this 2026-07-06 re-audit.
main.pdf rebuilt from the updated sources (106 pages, zero errors,
build-pass4.log retained).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Ch09.add_spec: [propext, Classical.choice, Quot.sound];
Ch09.mulVal_spec, Ch12.addFixed_spec: [propext, Quot.sound].
The Interlude's 'compiled and axiom-audited' phrase preceded its audit
by one pass — caught by coherence pass 2 and made true; ledgered per
the book's own Chapter 11 discipline.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- pen-and-paper worked examples in all 12 chapters, using the REAL
constants throughout: 2^-64 waiting-time arithmetic, headroom budgets,
hand type-checking, rfl traces, full goal-state boards, the column-sum
audit at 2^54, inverting 19 mod p via Euclid, the x19 fold at real
weights, denoting p itself (telescope), the 16p audit (8 fails by 151),
the 254+11 inversion-chain bookkeeping, the substitution test, sizing
the 28-vs-1000 extraction, cofactor/torsion arithmetic, and the full
Bernstein-Lange completeness derivation
- CORRECTNESS FIX: ch7 asserted a false factorization of p-1; replaced
with the computationally verified p-1 = 2^2 * 3 * 65147 * Q (Q 71-digit
prime), witness w=2 verified for all four Pratt conditions
- every chapter's exercises now followed immediately by 'Solutions and
pathways' (pathway first, then answer), incl. new exercises
- NEW Interlude: a complete two-clause verification done entirely by
hand, then mapped line-by-line onto the compiled Lean proof
- NEW appendices: A pen-and-paper toolkit (8 recipe cards + drills +
answers), B guided walkthroughs of every exercise-file hole, C tour of
the real repositories; plus glossary, instructor notes, 13-week plan
- preamble: worked-example box, solution macros, math-safe inline code
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- 53-page LaTeX/TikZ book (main.pdf + full sources): from zero background
to reading the real Ed25519/Pasta verification projects
- runnable exercises with sorry-holes + complete solutions for chapters
2-7, 9, 12; every solution file compiles clean (zero errors, no sorry)
against Lean v4.30.0-rc2 + Mathlib 5450b53e
- lake project pinned to the same toolchain/Mathlib the solutions were
verified with; students fetch the Mathlib cache, never build it
- honesty ledger in README: what was machine-checked and how
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
