The reverse direction for §6.3: katie verifying proofs this implementation built - #23
Merged
Conversation
…d that is the direction that cannot catch over-acceptance Every §6–§8 check so far runs the same way: katie serves a response and this side replays it, consuming the proof exactly. That establishes this side reads katie's ordering correctly. It cannot establish the converse — that a proof this side accepts is one katie would accept too — and that is the failure that matters for a verifier, because a verifier's bug is accepting too much rather than too little. It is also the failure the reverse direction caught the one time this project had a real bug: §12.1's balanced-subtree rule, which self-consistent proofs satisfied and katie rejected. So from-kt.json now carries CombinedTreeProofs built here for katie's own GreatestVersionSearch to consume, through its own ReceivedProofHandle. No signing is involved and none is needed: katie's algorithm layer verifies a proof without a tree head, so this side stays a verifier rather than having to become a log to be checked as one. handle.Finish() is katie's version of §12.3's exact-count rule, which makes this the mirror image of the replay check. Four of the five cases are deliberately wrong, since those are the ones with something to prove: a timestamp too many, a prefix proof too few, the proofs reordered, the timestamps descending. katie refuses all four and accepts the honest one. One fixture decision worth stating. The configuration those proofs are checked against sets the clock bounds enormous, because §4.2 has a verifier compare the rightmost timestamp against its own clock — deployment policy rather than a property of a proof — and these fixtures carry fixed timestamps so that from-kt.json regenerates to identical bytes. Making the fixture track the wall clock would trade a reproducible artifact for a check that belongs elsewhere, and tree-head.json already pins the clock bounds themselves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every §6–§8 check so far runs one way: katie serves a response, this side replays it and consumes the proof exactly. That establishes this side reads katie's ordering correctly. It cannot establish the converse — that a proof this side accepts is one katie would accept — and that's the failure that matters for a verifier, because a verifier's bug is accepting too much.
It's also the failure the reverse direction caught the one time this project had a real bug: §12.1's balanced-subtree rule, which self-consistent proofs satisfied and katie rejected.
What this adds
from-kt.jsonnow carriesCombinedTreeProofs built here, fed to katie's ownGreatestVersionSearchthrough itsReceivedProofHandle. No signing is involved and none is needed — katie's algorithm layer verifies a proof without a tree head, so this side stays a verifier rather than having to become a log to be checked as one.handle.Finish()is katie's version of §12.3's exact-count rule, which makes this the mirror image of the replay check: where the replay asks whether we read katie's ordering, this asks whether katie reads ours.Four of the five cases are deliberately wrong, since those are the ones with something to prove:
One fixture decision
The configuration these are checked against sets the clock bounds enormous. §4.2 has a verifier compare the rightmost timestamp against its own clock — deployment policy, not a property of a proof — and these fixtures carry fixed timestamps so
from-kt.jsonregenerates to identical bytes. Making the fixture track the wall clock would trade a reproducible artifact for a check that belongs elsewhere;tree-head.jsonalready pins the clock bounds themselves.214 reverse-direction artifacts: 110 accepted, 104 rejected, 0 disagreements. 6706 checks / 789 cases / 18 suites forward.
cargo fmt,clippy -D warnings, tests green.🤖 Generated with Claude Code