Ecosystem metrics
- New Repos
- 15
- down 99.2%
- Commits
- 904
- up 1.5%
- Releases
- 3
- down 70.0%
- Contributors
- 50
- up 0.0%
- Merges
- 47
- up 62.1%
Activity Overview
Commits and releases over time
- Commits
- Releases
- Authors
Repository Explorer
No repositories match that filter.
6649 commits in all time
May 29, 2026 18:43 – Aug 27, 2026 18:43 UTC
comment about seeds
Co-authored-by: Cosimo Bassi <65770425+cusma@users.noreply.github.com>
208da7a6
f512-support
1/2 ++ 1 --
Merge pull request #655 from algorandfoundation/docs/block-throughput
9929271c
main
2/6 ++ 4 --
Update src/content/docs/getting-started/why-algorand.mdx
Co-authored-by: JBScaled <164410456+JBScaled@users.noreply.github.com>
c6c1a0f2
main
1/1 ++ 1 --
Merge cd09941172a0f78a5fef611017d89b371ed30938 into 522755619852833e282c35eb841e062d03142814
b0be8793
pull/655/merge
2/6 ++ 4 --
Update src/content/docs/getting-started/why-algorand.mdx
Co-authored-by: JBScaled <164410456+JBScaled@users.noreply.github.com>
cd099411
docs/block-throughput
1/1 ++ 1 --
Update src/content/docs/getting-started/why-algorand.mdx
Co-authored-by: JBScaled <164410456+JBScaled@users.noreply.github.com>
1afb3e84
docs/block-throughput
1/1 ++ 1 --
Update src/content/docs/concepts/transactions/blocks.mdx
Co-authored-by: JBScaled <164410456+JBScaled@users.noreply.github.com>
c11de271
docs/block-throughput
1/1 ++ 1 --
Merge pull request #654 from algorandfoundation/fix/nav-python-ts
52275561
main
2/8 ++ 30 --
Regenerate contracts/out from the merged source; align the client checks
Merging 13 sequential PRs, each of which regenerated the TEAL from ITS OWN source, left contracts/out as a textual git-merge of compiler outputs. The teal-matches-source gate classified it precisely: STALE ARTIFACT -- instruction streams identical (nothing deployed or tested was wrong), but the emitted '// inscription.py:NNN' references pointed at the wrong lines, misleading any auditor tracing TEAL back to source. - contracts/out regenerated with the exact pinned invocation (cd contracts; puyapy inscription.py --out-dir out --target-avm-version 12; puyapy 5.8.1, algorand-python 3.5.0). verify_teal_matches_source now exits 0: every artifact byte-derives from the merged source. - trelyan_client.py regenerated from the fresh arc56. - verify_teal_matches_source's embedded-client comparison now excludes compilerInfo/sourceInfo -- the generator drops build metadata on embedding, so full-JSON equality fails FOREVER on a freshly generated client (observed today, the first day this comparison ran against a same-day regen). The behavioral keys all still participate. Mirrors verify_client_matches_arc56.py. Verified after regen: teal-matches-source exit 0 (six ok lines including the client), verify_client_matches_arc56 OK, contract suite on a fresh LocalNet 28/28 with real Falcon signatures. Windows note for the next person: puyapy resolves 'python' via VIRTUAL_ENV or the system path -- without VIRTUAL_ENV set, the WindowsApps store shim wins and compilation dies with "Python was not found". Set VIRTUAL_ENV to the compile venv when invoking outside CI. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
14515d48
main
5/81 ++ 71 --
Merge pull request #39 from brandonjsellam-Releone/feat/vendor-falcon-det1024
Vendor the pinned det1024 tree + Rust trelyan-pq (ffi/core), KATs first
a7d257b5
main
229/1,664,755 ++ 48 --
The generated client was deploying a JUNE program; regenerate it and gate the link
Running the LocalNet contract suite for the first time since the PR stack merged
produced three honest failures: the zero-address and TCE-76 guards, present in
the source AND the committed TEAL, were absent at runtime. Root cause: the suite
deploys through trelyan_client.py, whose embedded _APP_SPEC_JSON is frozen at
generation time -- and it was last generated in June. The coverage map had a
hole exactly one file wide: verify_teal_matches_source proves source -> TEAL,
contract-drift proves TEAL -> deployed app, and nothing proved TEAL -> generated
client, which is the copy the tests actually exercise.
- contracts/trelyan_client.py regenerated from the committed arc56 (one line:
the embedded spec). All 28 LocalNet tests now pass against a program carrying
every merged guard.
- contracts/verify_client_matches_arc56.py added and wired into the
teal-matches-source CI job. Behavioral-keys comparison (byteCode, methods,
state, bareActions, structs, name, arcs) -- full-JSON equality was tried
first and fails forever on a FRESH client, because the generator legitimately
drops compilerInfo/sourceInfo; that near-miss is recorded in the script
header. Proven to bite: against the June client it exits 1 naming byteCode.
- Exit 2 ("could not compare") is failure, never agreement -- same rule as the
sibling verifiers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37ae9e63
main
3/90 ++ 1 --
Pre-register METHODOLOGY v4.1 (matched reference banks) with the S2 correction folded in
v4.1 replaces v4's placeholder references for the two governed judgments: - sign-kk crop reference = repeated sign-aa sessions (fresh keypair each), matched in protocol and count; crop-positive iff C_kk > max(C_aa), strict. - sign-rr raw rule = three states calibrated against a matched null-rr bank (clears / inconclusive_pool_offset / fail_beyond_reference); the PASS set is not enlarged; SHAPE and the raw state can never issue PASS or FAIL. - N = 20 accepted sessions per bank, IDs frozen before the governed experiment; permitted reuse enumerated; no within-session resampling. Correction (2026-08-20, from the full-team implementation review, recorded in place per the evidence discipline): the session's own gating A/A control is a conditioned draw and is NOT a bank member; the AA bank is dedicated ungated sign-aa repeats only, minimum 2. No session had been judged under the uncorrected reading. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
0740f792
main
1/171 ++ 0 --
falcon-ct: fail closed when the null is empty, surface the A/A gate in the artifact, fix stale strings
V4_BACKLOG §A1-A5, all post-run because the harness is never rebuilt while a session measures. A1 (the one that mattered). judge_v2 used to compute p = (0+1)/(0+1) = 1.0 from an EMPTY null — a PASS-shaped number derived from nothing — while its SHAPE arm, guarded by n > 0, could never fire, so every experiment fell through to PASS. Not hypothetical: the ubuntu CI session of 2026-08-18 printed `crop max|t| = 38.17 p_emp = 1.000` and reported the sign-aa CONTROL as PASS with its shape arm never run. The gated experiments were saved by the control rule; sign-aa is read on its isolated verdict, so the control that gates the session was the one the defect could mislabel. Now: crop_empirical_p = None and INCONCLUSIVE, which is what "the diagnostic did not run" actually means. The PRIMARY statistic never depended on the null, so a real location difference still FAILs — fail-closed must not become fail-silent in the direction that hides a signal. Two regression tests, one per direction. A2. controls.aa_verdict / controls.aa_ok are now in report.json. The A/A downgrade is applied through a local flat_for_rule, so a failed control previously left controls_ok:true and flat:PASS in the artifact while every key verdict read INCONCLUSIVE — the sign-aa row was the only trace. A3-A5. READING_GUIDE now documents sign-aa and its downgrade-only gate. The sign-kk description no longer says "fixed message M0" (v3 replaced it with a four-message rotation) or "the per-key timing fingerprint measured directly" — the barred word, and it presupposed the finding; it now says what the design is and that a per-key difference is what the experiment TESTS FOR, never what it assumes. Two doc comments stopped calling the v3 real-operation null a "flat-control null", and crop_empirical_p's docs now state that None means the diagnostic did not run. 40 tests green, fmt + clippy -D warnings clean. No decision rule changed; A1 is strictly restrictive (it converts an unearned PASS into INCONCLUSIVE). Security Impact: no vendored C, no build flags, no signer path. Evidence-layer only, and every change removes a way for the harness to report more confidence than it earned.
768ffa34
main
2/135 ++ 12 --
CT_REPORT: add §4c (the v3.1 reading) and give the document a current-state header
§4c, the reading of the 82k session: - All five pre-registered gates passed; SESSION VERDICT PASS at MDE90 ~= 14.5 us (against a planned 30-42 us - the machine was quieter, sd 350-357 us vs the 425-1039 us planning band, so the session DOES resolve the 12-17 us range every earlier session was blind to). - sign-aa puts the arm offset at +1.40 us with a CI of [-3.53, +6.33] - EXCLUDING +13.9 us. The control added the day before has answered its question: no systematic arm/layout offset of that size on the machine where the 8-of-9 pattern was observed. The pattern also failed to reproduce (this session: +4.05, -7.22, -6.94; pooled 9 of 12, two-sided p ~= 0.15). - Exactly what the PASS licenses, and the list of what it does not license at any sample size. - A predictions scorecard including the one that was WRONG (sign-key predicted a near-certain FAIL at E|t| ~= 12.5; observed t = 2.36, PASS) and why: it assumed v3b's point estimates were true. So did the 44% FAIL forecast. Both failed for the same reason. - The methodological result, which is worth more than the verdict: the +12-17 us deltas that three rounds of council review forced this repo to withdraw have now failed to reproduce at 17x the samples, INCLUDING THEIR SIGN. Sub-threshold t with a CI excluding zero is a documented non-replicating shape here, not a weak signal. - Recorded before anyone reads them as a finding: two gated pairs again show that same shape, now negative. Fourth session running; the first three did not replicate. Document header rewritten: the top of this file previously presented the WITHDRAWN v1 FAIL as the report's verdict, so a reader who skimmed left with the wrong finding (flagged by the pre-run language audit). There is now a five-row table of every session, its verdict and what it is worth today, with the standing statement that nothing here is a constant-time claim. Earlier sections stay unedited except where a correction is marked - the record of what was claimed and withdrawn is itself the evidence that the process works. Security Impact: none - documentation. No code, no vendored C, no flags. The net effect on claims is restrictive: one over-broad header removed, one PASS bounded by a stated MDE90, and a previously live hypothesis (arm layout) excluded by measurement rather than by argument.
8e918af0
main
1/144 ++ 3 --
rust-ci: stop re-running a 20-minute measurement session on documentation commits
Eight concurrent rust-ci runs had queued on PR #39, most of them behind markdown-only commits. Three causes, three fixes, all in the workflow file: 1. A pull_request path filter is evaluated against the PR's CUMULATIVE diff, not the newest commit. PR #39 has touched rust/** and third_party/** extensively, so every later push to the branch matches the filter no matter what it changed. That is GitHub behaving as documented and the filter cannot express "what this commit touched" -- so the fix is the concurrency group below, not a cleverer filter. 2. push and pull_request both fired for the same SHA, running everything twice. push is now restricted to the default branch; pull_request already covers PR branches. 3. No concurrency group, so superseded runs kept going. Added, with cancel-in-progress: a superseded run reports on code nobody has any more. And the falcon-ct evidence session no longer runs per-push -- it is now schedule (weekly) plus workflow_dispatch. It costs 20+ minutes, and its verdict is currently INCONCLUSIVE BY CONSTRUCTION on this class of runner: the null gate is a fixed |t| < 4.5 applied to a pool-vs-pool null whose spread grows as the environment gets QUIETER, sd(t)^2 ~= 1 + (sigma_key/sigma_total)^2 * (n/32). The runner's sigma_total is ~32 us against the laptop's 350-733 us, so 5 of 20 null sessions tripped the gate and voided the session while BOTH synthetic controls behaved perfectly (evidence/ct/OBSERVATION_ci-ubuntu-2026-08-18.md). Until the v4 null lands, a per-push session spends runner time re-deriving a known INCONCLUSIVE. Weekly plus on-demand keeps its real value -- it is also the end-to-end smoke test of the harness, and it is what caught that the v3.1 binary ran correctly before the 5.5-hour local session. The reason to restore the per-push trigger is written into the job so it is not forgotten: when the v4 null makes a CI session capable of a verdict again. Security Impact: none. CI scheduling only -- no gate weakened. Every correctness job (3-OS KAT, fmt+clippy -D warnings, MSRV, cargo audit + deny) still runs on every relevant push and PR; only the non-gating observation job moved off that cadence.
72ec2486
main
1/33 ++ 6 --
falcon-ct: add the v4 null-ss construction, and make an `ss` session unable to issue a verdict
Increment 1 of METHODOLOGY-v4 (committed first, fb96211). Put to the FULL six-seat team as a
red/blue/apex `council run` per Brandon's standing directive of 2026-08-19 ("use always the
entire team for all tasks", now charter 3.0). The team found six defects; all six are fixed
below, and one of them changed the design.
WHAT THIS ADDS
- --null-design rr|ss, default rr. `ss` = ONE fresh 32-key pool, BOTH classes drawing from it by
INDEPENDENT index streams: E[mean0-mean1 | pool] = 0 by construction, mixture shape preserved
(which a single-key A/A null cannot give). `rr` is unchanged, so no session changes its rules
without saying so on the command line.
- controls.null_raw_t_sd -- the one number METHODOLOGY-v4 2 pre-registers as the validation
reading -- printed with its pre-registered band and recorded in report.json. schema_version 5.
- Per-null-session logging for both designs.
WHAT THE TEAM CHANGED (apex action 4, the one that matters)
`ss` narrows the null while 2a's compensating matched crop references are NOT wired, so the same
fixed |t| < 4.5 gate trips LESS often: selecting `ss` was a route to an easier pass. My claim that
"v4 makes sessions harder to pass, never easier" was true of the SHAPE arm and false of the gate.
A change that makes a session easier to pass may not also be allowed to issue the verdict, so:
VALIDATION-ONLY MODE. Under `ss` every experiment is marked ungated and session_verdict is
INCONCLUSIVE, with report.validation_only = true and a loud console line. METHODOLOGY-v4 2 already
said "nothing in session 1 is read as evidence about the signer" -- that was prose a reader
holding report.json would never have seen. It is now enforced.
THE OTHER FIVE
- sample_sd returned 0.0 for n < 2, and 0.0 <= 1.25 is the pre-registered PROCEED band -- a check
that cannot fail, reachable for real because the null loop breaks on the first session that
cannot run. Now Option<f64>, None below two observations, serialized as null, printed as
"UNDEFINED ... This is NOT the '<= 1.25 proceed' band -- it is no reading at all."
- The 1.25/1.60 lines are not enforced anywhere in code. Rather than pretend, the artifact now
says so: controls.null_raw_t_sd_gate = "human (METHODOLOGY-v4 2); no verdict reads this number".
The mechanical protection is validation_only above.
- --aa-repeats / --rr-sessions were parsed and never read: an inert knob, this project's dominant
defect class. I caught this myself before the review returned and the team confirmed it as
Critical. They are REFUSED with an explanation until 2a is wired, and --help says so rather
than advertising them.
- Parser guarantees were false as written: `--null-design rr --aa-repeats 1` was accepted because
the check tested the VALUE (!= 1) rather than whether the option was SUPPLIED, and
`--rr-sessions 0` parsed fine. Now presence-based, and zero is refused.
- The null-session error string was lost in a refactor (`could not run: {e}` -> `could not run`),
making keygen, allocation and FFI failures indistinguishable. Restored.
AND THE TEST THAT DID NOT TEST WHAT IT CLAIMED
`null_ss_arms_draw_independent_indices` checked only marginal coverage and P(a != b) ~ 31/32. A
reviewer supplied the counterexample: b := (a+1) mod 32, forced equal to a on 1/32 of positions,
passes both while being a deterministic function of a. Independence is a property of the JOINT
distribution, so it now runs a Pearson chi-square over all 1024 (a,b) cells (mean 1023, sd ~45 on
1023 df; the shifted counterexample scores in the hundreds of thousands) and asserts no cell is
empty. Production was never wrong -- the two streams come from disjoint SHAKE halves -- but the
test would have gone green on a later correlated implementation.
43 tests, fmt + clippy pedantic/nursery -D warnings clean. Default rr path unchanged in what it
judges. Guards verified against a rebuilt binary (cargo test does NOT refresh target/debug).
Security Impact: no vendored C, no build flags, no signer path, no new dependency. Evidence-layer
only, and net restrictive: a new mode exists but it is structurally incapable of issuing a Falcon
verdict, one unearned PASS band is closed, and two false guarantees are made true.
648eb685
main
1/452 ++ 24 --
v4 draft, revision 2: withdraw the numerology, pre-register all three branches, price the design
A second review -- an independent reimplementation of welch_t / pooled_percentile / t_values /
crop_statistic that reproduces report.json exactly -- found seven defects in revision 1. Every
number below was re-verified locally before acting on it. The design survives; three of my claims
do not.
WITHDRAWN: "10.24 / 1.742 = 5.88, within 1% of the boundary". That number should never have been
computed. It divides a max-of-nine ORDER STATISTIC by an sd measured on the RAW t: the nine crop
t's have their own spreads across the 20 null sessions -- 3.82, 4.79, 5.21, 5.63, 4.69, 3.94,
3.24, 2.91, 2.33 -- and none of them is 1.742. The max is attained at crop 0.80 in 8 of 20
sessions and at six other crops in the rest, so it is not even a fixed statistic. Cropping also
shrinks the denominator (SE 2466 ns raw vs 906 ns at crop 0.50 on raw-sign-rr.csv), so removing a
location offset deflates the crop by MORE than the raw factor -- the opposite direction to what
"the same factor" assumed. And every stable-looking estimate disagrees: the chi-square band maps
10.24 to 4.03-7.73, spanning all three outcome branches; two decompositions give 4.97 and 7.31.
OVERSTATED IN ITS OWN CONSEQUENCE: "v3.1's PASS may flip". Revision 1 named only the middle
outcome -- the one that does NOT change the verdict. All three are now pre-registered, with
thresholds read off the code (SHAPE iff the crop exceeds ALL 20 null sessions; sign-kk combines at
>= 2 of 3; session = worst of kk_combined and sign-rr; the three kk crops are 3.4754 / 5.3584 /
5.8405):
>= 5.8405 nothing moves -> PASS unchanged
5.3584 - 5.8405 sign-kk-1 alone SHAPE -> PASS UNCHANGED (one pair cannot carry
>=2-of-3); one CT_REPORT row and one
sentence need correcting
< 5.3584 kk-1 AND kk-2 SHAPE -> session SHAPE
Flipping the SESSION needs the v4 null's crop max below 5.3584, not below 5.84.
AND THE BEST AVAILABLE PRIOR SAYS IT DOES NOT FLIP: v3b's 20 null sessions carry an inflation of
only 1.004-1.024, so they are ALREADY a v4-equivalent null on the location statistic. Their crop
max is 5.749 -- between kk-2's 5.358 and kk-1's 5.840, i.e. the middle branch. n = 2352 against
v3.1's 40180, so it settles nothing, but it is evidence and it belongs in the file.
FALSE AND WITHDRAWN: "every 'no SHAPE' reading in v2, v3, v3b and v3.1 was made against an
inflated null". Checked against the committed reports: v2's null was 24 FLAT-LOOP sessions -- a
NARROW null -- and v2 returned SHAPE on all six signing experiments, so it contains no "no SHAPE"
readings at all; v3's first run had null_ok:false and minted nothing; v3b's inflation was under
2.5% and immaterial. ONLY v3.1 had a materially inflated null. Over-claiming about this project's
own record is the exact failure this file exists to correct, and I did it.
ALSO FIXED:
- The contradiction between 2a and 3.3 over which reference judges sign-kk. Named: repeated
sign-aa. Ambiguity resolved BEFORE any measurement.
- "All ten experiments' raw samples are committed" -> report.json holds 9 experiments, the
directory holds 11 raw CSVs, SHA256SUMS covers 13. And the null side is NOT recoverable, so a
re-judge compares August's experiment crops against a null measured later, on different key
material, in a different thermal state. Stated.
- The design was never priced. Measured: mean sign is 7.7066 ms, one 82k block is 632 s, 20 null
sessions are 3.51 h = 63.6% of v3.1. Three references at 82k is ~10.5 h of null before an
experiment runs. So v4 session 1 is a VALIDATION run at v3b scale (~1 h) whose only job is to
answer whether null-ss gives sd(t) ~ 1; sizing a verdict session comes after. Running a 10-hour
verdict session on an unvalidated null would repeat the v3.1 ordering mistake at five times the
cost.
NEW 2b, alternatives rejected -- including one that would have been a disaster: a
label-permutation surrogate null returns sd(t) ~ 1 BY ALGEBRAIC IDENTITY whatever the data holds.
Run on raw-control-leaky.csv, whose raw t is -296.34, it returns 0.97. A reference that certifies
the deliberately leaky control is the check-that-cannot-fail defect this repo keeps a register
for. Excellent regression fixture, not a null.
AND a second confirmation of the defect that never touches a t statistic: sd(dmean) = 3229.8 ns
against rms(se) = 1839.1 ns implies a between-pool offset sd of 2655 ns, hence a predicted sd(t)
of 1.756 against 1.742 observed; both routes put sigma_key at 10.49 / 10.62 us.
Still a DRAFT, in force nowhere.
Security Impact: none - a design document. No code, no vendored C, no flags, no rule in force.
2fe7ebcf
main
1/131 ++ 28 --
CT_REPORT §4c.1: withdraw the arm-artefact conclusion after council review (5 of 6 OVERSTATED)
The first draft of §4c.1 said the v3.1 sign-aa control "establishes that the +12-17 us deltas recorded in v2/v3/v3b were not a systematic arm or memory-layout artefact". Put to the six-seat R&D council under the standing rule for a claim about to be relied on: five of six returned OVERSTATED (the sixth is the watsonx seat, documented in the charter as restating what it is handed). The objections are correct, so the claim is withdrawn and replaced by what survives. WITHDRAWN, and why - five independent objections, all upheld: 1. CROSS-SESSION INFERENCE. The control ran in v3.1; the deltas are from v2/v3/v3b. That step assumes harness, allocator, build and layout were unchanged across them - and the version numbers are themselves evidence they were not. An artefact present earlier and perturbed by v3.1 produces exactly this pattern. (All five seats.) 2. A SAME-KEY CONTROL IS BLIND TO CONTENT x ARM INTERACTIONS. Cloning one keypair zeroes an offset that depends only on position or address; it cannot see effects requiring the two arms to hold DIFFERENT key material - cache-set conflicts, page colouring, content-dependent execution meeting arm-specific state. Those are still layout artefacts. 3. ONE LAYOUT DRAW. Placement is a draw from a distribution; one aa pair samples one placement. 4. POWER DOES NOT REACH THE BAND. MDE90 ~= 14.5 us sits at or above the low end of 12-17 us; a true 12 us offset is t ~= 4.8 against a 4.5 gate. The CI excludes +13.9 for a constant additive offset; the session is not a high-power refutation of 12 us. 5. FAILING TO DETECT IS NOT EQUIVALENCE. "No effect larger than X" needs a pre-registered margin and TOST (Schuirmann 1987), which was not pre-registered. Plus: the naive CI assumes iid, and 82k timings on one laptop are serially dependent. SURVIVES: in the v3.1 session, on that build and layout, a constant additive arm offset is +1.40 us with a CI excluding +13.9 us. The hypothesis is weakened for constant additive offsets in the current build and otherwise still open. Also withdrawn: the consequence that de-prioritised sign-kk arm randomisation on the strength of sign-aa. It stays on the v4 list, joined by four new items the review generated - replicate the A/A control across layout draws; a DIFFERENT-key swapped-arm control (the only design that can close the artefact question rather than narrow it); cluster-robust/block-bootstrap SEs; and TOST with a pre-registered margin for any bounding claim. This is the fifth reading this document has had to weaken, and the first where the flawed step was an INFERENCE of mine rather than a number. Recorded in place rather than quietly rewritten. Security Impact: none - documentation. Strictly restrictive: a conclusion is withdrawn, no new claim is made, and a de-prioritised control is restored to the work list.
bfc6ba25
main
2/84 ++ 15 --
METHODOLOGY-v4: correct "harder to pass, never easier" — it is false for the gate
The full-team review of the implementation caught a claim I had made in the draft and repeated in commit messages: that v4 "makes sessions harder to pass, never easier". True of the SHAPE arm (a narrower null makes SHAPE more likely); FALSE of the gate, because a narrower null trips the fixed |t| < 4.5 line LESS often. `ss` therefore lets through sessions `rr` would have voided. That is the intended correction -- they were being voided for arithmetic rather than environmental reasons -- but it is still a liberalisation, and it lands BEFORE 2a's compensating matched references exist. So the file now states the restriction that the harness enforces: a session run with --null-design ss CANNOT issue a Falcon verdict. Every experiment ungated, session_verdict INCONCLUSIVE, report.validation_only = true, and the only reading is controls.null_raw_t_sd. The restriction lifts when 2a is implemented and pre-registered in v4.1, not before. Also added to the 2 reading table: an UNDEFINED sd (fewer than two usable sessions) is not a reading at all and specifically not the "proceed" band -- the harness reports null rather than 0.0, because a false zero would land the decision in its proceed band on no data. And the table now says out loud that these lines are applied by a HUMAN: report.json carries controls.null_raw_t_sd_gate = "human ...; no verdict reads this number", so null_ok: true can never be mistaken for "2 was satisfied". Security Impact: none - a rules document. The net effect is restrictive: a mode that exists in the harness is declared incapable of issuing a verdict, and one reading that could have been satisfied by no data is closed.
f4aaabcd
main
1/20 ++ 0 --
Controls pre-registration DRAFT (team-designed, numbers-blind) - not in force
Six-seat zuss (8/9 seats), written under the blindness clause of PREREG_v41-release-replicate.md 3a(3): methodology only, no session values. Majority locks Option (a) - crop-shape is NOT part of the synthetic-control hypothesis, because a synthetic crop null cannot calibrate or gate the Falcon crop/SHAPE path (non-transfer); the interim raw-line ruling becomes permanent under it. The minority Option (b) draft (matched synthetic null family + planted-shape positive control with a numeric fire condition) is kept in full with the founder decision criterion, because the split is real. Takes force only as a dated pre-registration after the release-replicate decision, in the ruled order. Security Impact: document only, explicitly not in force; no rule changes until adopted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
7709cbe4
main
1/329 ++ 0 --
falcon-ct: apply the team review of 6df6999 (S1-S9) and retract two overclaims
Code (S8, S6): judge_raw_only now maps a non-finite raw t to INCONCLUSIVE (welch_t is total today, so the guard is unreachable through real samples and documented as such - it exists so INCONCLUSIVE-never-PASS survives a future welch_t change). The regression test is now TWO-SIDED: the same flat series judged v2-style against a bank built strictly below its own crop statistic is demoted to Shape (the live failure's mechanism), while raw-only Passes it - reverting the production wiring goes red. A constant series is asserted flat-and-finite -> Pass. Pre-registration amendment (S1-S5, prospective, before any run exists): instrument pinned to the amendment commit with cargo build --release --locked and recorded toolchain; null_raw_t_sd defined in the document (n-1 sample SD over the 20 null-ss raw t values); one-run/first-launch rule with every attempt kept and pre-measure environment capture; blindness clause over the quarantined banks until the controls pre-reg and section 6.1 are committed; reading gated on the replicate's own controls with all-20-or-no-reading; the partial band is a NO-PROCEED; the founder A/B choice is dated before any governed launch and a Branch A stop carries to Branch B. RETRACTIONS (S7, S9) - correcting my previous commit message and docs: "cannot lift any session verdict" was FALSE: removing the mismatched crop demotion can flip controls NOT-OK -> OK, which lifts control-blocked INCONCLUSIVEs back to their isolated verdicts - that lift is the ruling's intent and is now stated, not denied. And "the crop diagnostic does not run" overstated the implementation: crop statistics are still computed and retained as descriptive numbers; what is true is that no crop p against any bank is computed and nothing in the verdict path reads them. A raw-line fire on the flat control blocks the session pending diagnosis; it does not by itself diagnose an environment failure. Left open, tracked for the next increment: a bin-level wiring test through null_and_controls with the real generators, and verifying the leaky control's 40k/60k work survives release-profile DCE. Gates: fmt, clippy pedantic+nursery clean, 24 falcon-ct tests green. Security Impact: harness only. The changes narrow (NaN guard, pre-reg holes closed) or correct the record (retractions); no rule is loosened. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
0d4d7f22
main
2/64 ++ 5 --
falcon-ct: A6-A8 — put the null's reason in the artifact, log each null session, stop printing an empty range as a measurement
A6. controls.null_reason is now serialised. It existed only as a console line, so a reader holding report.json alone saw null_ok: false with no way to tell a too-noisy environment from sessions that never ran — and the console is exactly what does not survive (the CI job publishes to an expiring summary; a local run keeps it only if the launcher redirected it). A7. One line per null session as it lands, with an explicit marker when a session trips the gate. The null is two thirds of a long session's wall-clock and used to print its start and then nothing for hours: a crash inside it was diagnosable only as 'it died somewhere in the null', and a session drifting toward the gate was invisible until the end. On the ubuntu runner, where 5 of 20 sessions trip, this now shows as it happens instead of in a post-mortem. A8. With no usable null the min/max folds printed 'crop-stat range inf..0.00' — a range that reads like a measurement and is the empty set. Now 'none (null rejected)'. The fold is extracted into fold_null() so null_and_controls stays under the line limit and the empty-null display lives next to the decision that produces it. 40 tests green, fmt + clippy -D warnings clean. No decision rule touched; this is entirely about what the artifact tells a reader who was not present when it ran. Security Impact: none - no vendored C, no flags, no signer path.
adcd193b
main
1/67 ++ 28 --
v4 draft, revision 1: one null cannot do two jobs (council review, 5 CONFIRMED / 1 OVERSTATED)
The mechanism survived: two seats derived sd(t)^2 = 1 + (sigma_key/sigma_total)^2 * (n/32) independently and got the same expression, and both reproduced the numerical chain (sd 1.742 -> sigma_key 10.35 us -> sd(t) 2.945 on the CI runner). What did NOT survive is the single-null proposal. THE GAP, found independently by two seats (GPT-5.6 F5, Kimi F7): the inflation applies to ANY pool-A-vs-pool-B comparison, null or not -- INCLUDING sign-rr, which is a GATED EXPERIMENT. A same-pool null is matched to sign-kk and mismatched to sign-rr, so one null cannot serve both. REVISED DESIGN (new section 2a) -- match each null to the structure of what it judges: - environment gate: null-ss (one pool, both classes, independent draws). True zero, so a fixed |t| < 4.5 is meaningful. Kimi's independent derivation puts the per-session false-trip rate at ~6.8e-6, ~1.4e-4 over twenty sessions. - crop reference for sign-kk (fixed key vs fixed key): sign-aa repeated. True zero, same structure. - crop reference for sign-rr (pool vs pool): null-rr, i.e. the CURRENT null -- which is not a true zero and must therefore be used empirically, never against a fixed cutoff. AND THE CONSEQUENCE ONE LEVEL UP: sign-rr cannot be gated against a fixed threshold at all. Under NO leak its statistic carries the same inflation; at v3.1's numbers that is sd(t) = 1.742 and its observed |t| = 0.73 sits inside it, but at ~10x the samples sign-rr would cross 4.5 with no leak present -- the same failure the null sessions had on the CI runner. v4 must pre-register either judging it empirically against null-rr (recommended; costs nothing new) or de-gating it. STATISTICAL CAVEATS, all kept -- sigma_key was quoted far more precisely than 20 observations support: - sigma_key is not 10.4 us but roughly 6.3-17.0 us (chi-square interval on the t spread, 1.33-2.54). - 5 of 20 trips is CONSISTENT WITH sd(t) = 2.95, not confirmation: expected 2.5, P(X>=5) ~ 0.10. - Carrying sigma_key between machines is an assumption, not a derivation. Wording changed to "a consistent sigma_key explains both environments". - The formula is an approximation under a stated hierarchical model, not an identity: deterministic Welch denominator, 32-key CLT, within-pool key variance really (31/32)*sigma_key^2. Negligible for the variance at these n; only tail probabilities -- which is what a gate is -- carry it. - "Makes the gate valid again" is downgraded to "removes the dominant, growing term". Welch normality is asymptotic, temporal dependence can inflate it, and twenty tests keep a non-zero familywise trip rate. Still a DRAFT and still in force nowhere. The Claude-side audit of the same document is still running and may add more. Security Impact: none - a design document. No code, no vendored C, no flags, no rule in force.
0ae513d9
main
1/75 ++ 10 --
falcon-ct: interim controls ruling (synthetic controls judged raw-only) + pre-register the release replicate
Implements the dated interim ruling from the six-seat review of the v4.1 validation session: synthetic controls (control-flat, control-leaky) are judged on the raw |t| >= 4.5 line ONLY via the new judge_raw_only — the crop diagnostic does not run for them (crop_empirical_p = None), because a synthetic loop and the real signing operation do not share a crop null and judging one against the other is a mismatched reference. Observed live in the quarantined session: the flat control read "Shape" at raw t = 2.99 against the null-ss bank and flipped controls to NOT OK. The regression test pins exactly that shape: a flat series whose crop would fire against a tight real-op bank must still Pass, the leaky control must still Fail on the raw line, short samples stay INCONCLUSIVE. Whether a crop-shape control validation returns later — with its own synthetic reference family AND a synthetic-shape positive control with a numeric fire condition — is left to its own pre-registration, per the apex ruling that left (a)-vs-(b) genuinely open. READING_GUIDE documents the ruling in the artifact itself. Also: PREREG_v41-release-replicate.md — the release-harness replicate pre-registered BEFORE it can even be built (App Control still blocks fresh release exes; founder decision pending). One reading (null_raw_t_sd, the committed bands, registered as a low-information point-estimate call per review F4), explicit non-readings (no v3.1 re-judgment — that needs a matched-count 82k bank; banks frozen but unused until the controls pre-reg and a specified §6.1 exist), and a deviation rule that makes any off-spec run exploratory with the bands not applied — this morning's lesson, written down. V4_BACKLOG §A sweep: A1-A8 verified all closed by the v4/v4.1 work (A1 empty-null fail-closed with the CI session documented in judge_v2; A2 aa_verdict/aa_ok in Controls; A3 READING_GUIDE covers sign-aa; A4 sign-kk description corrected; A5 no "flat-control null" comments remain; A6 null_reason serialized; A7 per-session null logging; A8 fold_null). Gates: cargo fmt, clippy pedantic+nursery -D warnings clean, 24 tests green in falcon-ct (15 lib + 9 bin). Security Impact: measurement harness only; no crypto code. The change NARROWS what a control verdict may be based on (raw line only) and cannot lift any session verdict; the flat control can now block a session only for a genuine raw-line environment failure. To re-verify: the release replicate runs under the committed pre-registration once the harness decision lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
f37f5278
main
3/176 ++ 12 --
falcon-ct: implement v4.1 §2a reference banks, hardened by the five review findings
Implements the matched banks under --null-design ss: sign-aa repeats (fresh keypair each, ungated) form the sign-kk crop bank; a null-rr bank supplies sign-rr's crop reference and its three-state raw rule. rr design unchanged (refs_for_rr: everything = the gate null, no raw bank, byte-identical v3 judging). The full-team review's findings, each applied and tested: - S1: reference banks are all-or-nothing — collect_sessions returns Result and a failed session propagates instead of silently truncating the bank; rr_raw_state returns no_reference_bank / invalid_statistic (NaN) rather than relabelling harness faults as fail_beyond_reference. - S2: the gating A/A control is a conditioned draw and is excluded from the bank; ss requires --aa-repeats N >= 2 (enforced in check_v4_options and live via the CLI). - S3: tests exercise production paths — refs_for_rr is the function the rr arm returns, and the tests call it; the guard truth table calls check_v4_options itself. - S4: requested bank counts are serialized (aa_repeats_requested, rr_sessions_requested) because the rank floor 1/(N+1) makes N part of the rule. - S5: both banks' raw CSVs are written (bank_raws), not only judged crops. Gates: cargo fmt, clippy -D warnings (pedantic+nursery), 47 tests green, all four CLI guard paths exercised against the built binary. Security Impact: measurement harness only — no crypto code touched. What changed: reference-bank construction and the sign-rr raw rule under the ss design; ss sessions remain validation-only (ungated, INCONCLUSIVE, validation_only:true) until a pre-registration lifts it. What could break: a wrong bank would mis-calibrate future SHAPE annotations — mitigated by all-or-nothing collection, serialized requested counts, and production-path tests. To re-verify: the pending validation run reads only null_raw_t_sd. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2347829e
main
1/488 ++ 52 --