docs(core): Veridicality.antiConsensusGate — distinct roots ≠ independent roots - #10031
Merged
AceHack merged 1 commit intoAug 4, 2026
Conversation
…ts ≠ independent roots Soundness-audit finding #2 (Caveat-A bug class: independence asserted, not verified) — and higher-stakes than #1 because this is a TRUST-UPGRADE gate. The gate counts distinct RootAuthority LABELS (cardinality >= 2) and calls it "independent roots", but distinct labels are not proof of independent sources: RootAuthority is self-asserted metadata, so a Sybil defeats the gate by presenting one real source under two labels — the exact pseudo-consensus the gate's own docstring says it rejects; and two genuinely-distinct roots can still be correlated via a shared upstream. Independence is ASSERTED (via label-distinctness), not verified. validateProvenance does not help (format/signature check only, confirmed). The gate NAMES the sybil problem but does not USE the anti-sybil machinery that now exists. Fix is Beacon-honesty (no behavior change): document that the gate is a one-way FIRST filter (failing convicts single-source pseudo-consensus; passing does NOT certify independence), and point to AntiSybil.chshSybilCalibrated as the real same-source test to compose upstream for adversarial trust upgrades. Deeper fix (wire the anti-sybil check in) is a follow-up needing a RootAuthority→identity-stream mapping. Same discipline as the CountMin (#10030) and chshMargin caveats. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
AceHack
deleted the
docs/veridicality-anticonsensus-gate-distinct-not-independent-caveat-20260804
branch
August 4, 2026 16:17
AceHack
added a commit
that referenced
this pull request
Aug 4, 2026
…scipline mostly held) (#10032) Captures the self-directed audit for the Caveat-A bug class (a probabilistic guarantee resting on an independence property the construction doesn't deliver). 2 findings fixed as Beacon-honesty caveats (CountMin's "provable" overclaim #10030; Veridicality's distinct-labels-≠-independent-roots trust gate #10031); 4 honest negatives (BloomFilter / IBLT / HyperLogLog all correctly hedged — the exemplars — plus SignalQuality's weighted-mean and MetaCart). Conclusion: not "two bugs" but that the codebase's statistical honesty is mostly holding — 3 of 4 guarantee-bearing sketches hedge correctly, and the audit caught the one drift and brought it up to its siblings' standard. Two promotable patterns: soundness-bias the failure mode (IBLT Partial / anti-sybil one-way), and hedge to the independence you actually have. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Soundness-audit finding #2 (Caveat-A class: independence asserted, not verified) — and higher-stakes than #1 (CountMin, #10030) because this is a trust-upgrade gate.
The finding
antiConsensusGatecounts distinctRootAuthoritylabel strings (≥ 2) and calls that "independent roots." But distinct labels are not proof of independent sources:RootAuthorityis self-asserted metadata — a Sybil defeats the gate by presenting one real source under two labels. That is the exact pseudo-consensus the gates own docstring says it rejects ("50 claims tracing to a single upstream source").So independence is asserted (via label-distinctness), not verified.
validateProvenancedoes not close it — confirmed format/signature-only. The gate names the sybil problem but doesnt use the anti-sybil machinery that now exists.The fix (Beacon-honesty, no behavior change)
Documents that the gate is a one-way first filter: failing (
< 2labels) convicts single-source pseudo-consensus; passing does NOT certify independence. Points toAntiSybil.chshSybilCalibratedas the real same-source test to compose upstream when the trust upgrade is adversarial. Deeper fix (wire the anti-sybil check in) is a flagged follow-up needing aRootAuthority→identity-stream mapping.Audit status
Same discipline as CountMin (#10030) and the
chshMargincaveat. Also checkedSignalQualitythis round — clean (its composite is a weighted mean, consciously not a product, so no independence assumption; honest negative, no finding).🤖 Generated with Claude Code