sworn v0.2: attacked twelve ways, four rules paid, the coverage number withdrawn — and the plan it serves

[fathomlab]

sworn v0.2: the format is attacked twelve ways, pays four rules, and withdraws the number it printed beside every verdict — plus the plan it serves

Three commits, in the lab's order: spec frozen, then code, then the documents sworn to the code.

What ships

The adversarial pass the standing rule requires (papers/sworn/ATTACKS_sworn_v01_battery_2026_09_02.md, sworn, 22 spans; pinned by tests/test_sworn_attacks.py). Twelve attacks against styxx.sworn as committed at 320b303. Four repaired, six not repaired and stated beside the verdict, two unchanged from v0.1.

SPEC_sworn_output_v02_2026_09_02.md, frozen before code; styxx/sworn.py v0.2:

• R1 rN#/pointer, rN#Ln-Lm
• R2 a tag inside an HTML comment is MALFORMED hidden_commitment
• R3 a quote needle under 16 bytes over a whole receipt is MALFORMED short_needle (pointer leaves, line anchors, absent exempt — the attack is the haystack)
• R4 the cap counts 300 code points
• R5 attestation source kind; no signature checked, and certifies says so
• R6 manifest sworn/manifest/0.2 declares a rung — L1 (local hook, weak) or L2 (runner after the turn); L3 reserved; 0.1 still loads at undeclared
• R7 provenance on every span, rungs on every receipt
• R8 the coverage estimate is withdrawn. Its denominator (styxx.claimdetect, STRUCT-1) is a diff-claim detector for agent PR prose that never reads a measured rate as a claim. coverage_census_v01.py (git plumbing at 320b303): it printed 0.6667–1.0 beside all twelve committed sworn documents while counting 20 of 932 narrative sentences. Replaced by narrative_sentences and sentence_share, a floor that cannot flatter (0.0156–0.2185 on the same twelve), and STRUCT-1's count labelled with its idiom.
• R9 receipt /v1 digests its core without coverage; verify_receipt is schema-aware and /v0 still checks. All twelve committed receipts re-issued by reissue_receipts_v1.py, which refuses if any span verdict moves; none did.
• every JSON the CLI writes is LF on every platform (a Windows text-mode write would have CRLF'd a byte-pinned sidecar)

papers/PLAN_the_next_level_2026_09_02.md (sworn, 20 spans): the move a six-lens design panel and nine adversarial reviews left standing, with a claim ledger — what may be said now, only with the qualifier, never.

papers/sworn/DESIGN_sworn_measurement_v2_2026_09_02.md: eight repairs to the v0.1 measurement design — two seat families on this box (no API credits needed), per-family two-sided decoys, Q1 in three cells, a receipt-seeing panel, a seeded-canary arm so FAILED precision has a denominator, the HELD-but-false cell, arms in order of receipt availability. Waits on one signature on the bars.

papers/closed-model-frontier/EXPLORATORY_handedness_by_kind_2026_09_02.md (sworn, 20 spans): the token-kind split of the v3 rows that a same-day objection cited as "kind-adjusted 0.117" with no receipt. The receipt says 0.1695, integer-stratum odds ratio 3.11, one repository supplying 184 of 334 rows. Exploratory; never a result.

RESULT_sworn_v02_ships_2026_09_02.md (sworn, 14 spans, rung L1 printed).

What it does not say

That the format has been measured (owed, redesigned, waiting on a signature). That any rung above L1 exists in the tree. That the attacker was independent (the builder ran the battery). That anyone can pip install this (styxx.sworn is unreleased).

Verification

• tests/test_sworn.py, test_sworn_attacks.py, test_sworn_dogfood.py, test_sworn_eol.py: 504 passed
• tests/test_index.py, tests/test_ledger.py: passed with the new documents in the tree
• full suite on this box: 3703 passed at main; the feature-branch run is in the PR checks
• ruff check clean on every touched file

Operator-gated, named

The signature on the DESIGN v2 bars. A release carrying styxx.sworn. Any .github/ workflow for the sworn action (leg 3 of the plan; not in this PR).

🤖 Generated with Claude Code