{ "_doc": "One result, read from the codebase’s own files at the commit named here. Every value is that file’s own, copied verbatim; nothing here is written by hand. A value replaced by {withheld: true, sha256_of_value, bytes} is committed by its sha256 instead of published, for the reason it states, and is never edited. Each whole source file is committed by sha256 below, and its bytes are published only where its visibility says so. The codebase is named by the public subject its files are published under.", "lane": "wireless-pqc", "repository": "wireless-pqc", "commit": "c5f34eda4cc9f7f86308a5db1cfa75efcd4c6841", "portfolio_id": "wireless-pqc:unseeded-hunt-11200", "id": "unseeded-hunt-11200", "attestation_row": { "attested_at": "2026-10-03", "attestor": "03-wifipqc", "repository": { "withheld": true, "why": "a working-directory name (R8)", "sha256_of_value": "6f37ed958c37482bf7ee04acba61df04492fe3186c1ba6c10b77519cd450c69f", "bytes": 7 }, "source_doc": "CROWN_JEWELS_RESOLVED.md", "source_doc_sha256": "e90dc2b52a6d04ebdf103d7262d9ef1f6336f4b8a0ff518b9dbf308bc810fe8e", "state": "attested", "top_n": 26, "note_sha256": "c1af3e3220ffc4290cc975a79bf85d216638fd8abd3f4d8e7e67f6f5af0aff3b", "ids_in_row": 26, "file": "dataroom/TOP_N_ATTESTATION.jsonl", "line": 1 }, "claim_source": { "receipt": "wireless-pqc/dataroom/top40.json", "sha256": "5b765e618185384adc31381c60605ec146bb0f0c1c7352424a8929d2c0d98f14", "field": "entries[33].claim", "file": "dataroom/top40.json" }, "top40_entry": { "id": "unseeded-hunt-11200", "portfolio_id": { "withheld": true, "why": "a working-directory name (R8)", "sha256_of_value": "6f7aca7ea9cb985819659ad70d5502dcab8bfa1dcae11e29204b10172ba06070", "bytes": 27 }, "rank": 34, "native_rank": 29, "title": "An unseeded adversary searched 11,200 compound attacks and found zero escapes; an exhaustive enumeration of all 53,485 compounds of up to three attack families found none either", "claim": "An unseeded adversary searched 11,200 compound attacks over the whole design axis and found zero escapes, with every elite non-vacuous; an exhaustive enumeration of the same grammar, every compound of up to three attack families on all ten designs, 53,485 in all, also found zero escapes.", "scope": "Exhaustive only up to three families per compound; budgeted above that. Every compound of one to three families from each design's composable alphabet was enumerated on all ten designs (53,485) and none escaped: a closure over this declared grammar at those orders only. Compounds of four to ten families are covered only by the MAP-Elites hunt, whose 11,200 evaluations are a budget: zero escapes within it is a null result, not a theorem. A verifier crash counts as FAILURE, never as an escape.", "limits": "Exhaustive only up to order three; budgeted above it. The enumeration covers every compound of one, two or three attack families (317, 4,870 and 48,298 compounds; 53,485 in all) drawn from each design's own composable alphabet, 31 to 33 of the 34 families of attacks.ATTACK_FAMILIES, on all ten designs, judged by the same frozen verifier as the hunt (discover._all_invariants_hold through qd_discover._Evaluator). A compound is a set of families applied simultaneously, their adversaries merged field by field by discover._merge_adversaries, so orderings and repeated families are not in the grammar (the hunt's genomes are sets too), and neither are attacks modelled outside that table: discover.py names roam_ticket_replay, puzzle_replay, offline_dictionary and online_guess as non-composable. Designs, attacks and verifier are the lab's own Python model, not hostapd or wpa_supplicant. The same enumeration with KRACK re-opened (idempotent_install off) finds 10 escapes among the 317 one-family compounds, and at every order some compounds break the naive stack, so the closure is not over no-ops. Compounds of four to ten families are covered only by the MAP-Elites hunt: 11,200 evaluations is a budget; zero escapes within it is a null result, not a theorem. A verifier crash counts as FAILURE, never as an escape. The earlier \"2,146,200 evaluations\" headline is no longer stated (Appendix A, D-5); the runnable floor is 5,600 and this run is 11,200.", "artifact_path": "artifacts/native/unseeded_hunt_ci.json", "witness_command": "make unseeded-hunt", "witness_result": { "status": "RAN", "exit": 0, "line": "WITNESS unseeded-hunt-11200: OK -- 2 claim figure(s) bound at 6 site(s)", "seconds": 224.1, "run_at": "2026-09-26T17:38:21Z", "owner_gated": false, "reason": null, "run_of_record": "clean clone at HEAD (S03, dataroom/witness_quality_20260913/clean_clone_baseline.json)" }, "third_party_axis": "—", "facts": { "ran_with_receipt": true, "third_party_graded": false, "negative_control_stated": false, "ip_class_known": false, "reproduce_command": true, "regenerates": false }, "fact_count": 2, "repro_command": "make unseeded-hunt", "ip_class": null, "ip_class_basis": "no source in this repository states an IP class for this entry; never guessed" }, "witness_quality_entry": { "id": "unseeded-hunt-11200", "portfolio_id": { "withheld": true, "why": "a working-directory name (R8)", "sha256_of_value": "6f7aca7ea9cb985819659ad70d5502dcab8bfa1dcae11e29204b10172ba06070", "bytes": 27 }, "title": "An unseeded adversary searched 11,200 compound attacks and found zero escapes; an exhaustive enumeration of all 53,485 compounds of up to three attack families found none either", "claim": "An unseeded adversary searched 11,200 compound attacks over the whole design axis and found zero escapes, with every elite non-vacuous; an exhaustive enumeration of the same grammar, every compound of up to three attack families on all ten designs, 53,485 in all, also found zero escapes.", "class": "ASSERTING", "why": "clean-clone exit 0; every decisive planted defect went red: [0] reopen KRACK under the full envelope (combined_config idempotent_install True -> False): an escape now exists -> exit 2", "witness_command": "make unseeded-hunt", "clean_clone": { "exit": 0, "status": "RAN", "seconds": 224.1, "first_line": "liboqs-python faulthandler is disabled", "last_line": "WITNESS unseeded-hunt-11200: OK -- 2 claim figure(s) bound at 6 site(s)", "artifact_rewritten": false, "dirtied": [], "run_at": "2026-09-26T17:38:21Z", "reason": null }, "planted_defects": [ { "index": 0, "what": "reopen KRACK under the full envelope (combined_config idempotent_install True -> False): an escape now exists", "falsifies": "property: zero escapes", "decisive": true, "planted": [ { "path": "lib/wifipqc/repairs.py", "diff": "' bind_transcript=True, idempotent_install=True,' -> ' bind_transcript=True, idempotent_install=False,' (x1 of 1)" } ], "exit": 2, "seconds": 58.6, "last_line": "make: *** [unseeded-hunt] Error 1", "failure_moved_by": null }, { "index": 1, "what": "shrink the search budget (1400 -> 1000 per generation): the claim's 11,200 becomes 8,000", "falsifies": "number: 11,200 compound attacks searched", "decisive": false, "planted": [ { "path": "tools/hostapd_pqc/unseeded_hunt_ci.py", "diff": "'BUDGET = int(os.environ.get(\"UNSEEDED_BUDGET\", \"1400\"))' -> 'BUDGET = int(os.environ.get(\"UNSEEDED_BUDGET\", \"1000\"))' (x1 of 1)" } ], "exit": 2, "seconds": 215.6, "last_line": "make: *** [unseeded-hunt] Error 1", "failure_moved_by": null }, { "index": 2, "what": "PLAN5-S3 P3.4: the exhaustive sweep stops at order 2 (EXHAUSTIVE_KMAX default 3 -> 2): it still finds 0 escapes, over 5,187 compounds instead of the claim's 53,485", "falsifies": "number: 53,485 compounds enumerated exhaustively (every compound of up to three families on all ten designs) -- the artifact's count becomes 5,187 and the claim-binding leg must see its recorded sites no longer carry 53,485", "decisive": false, "planted": [ { "path": "tools/hostapd_pqc/exhaustive_compound_closure_ci.py", "diff": "'K = int(os.environ.get(\"EXHAUSTIVE_KMAX\", \"3\"))' -> 'K = int(os.environ.get(\"EXHAUSTIVE_KMAX\", \"2\"))' (x1 of 1)" } ], "exit": 2, "seconds": 69.4, "last_line": "make: *** [unseeded-hunt] Error 1", "failure_moved_by": null }, { "index": 3, "what": "PLAN5-S3 P3.4: the exhaustive sweep's built-in control is blinded -- its control envelope keeps KRACK closed (idempotent_install=False -> True), so the enumeration machinery is never shown to detect an escape", "falsifies": "clause: the enumeration is not vacuous -- the same machinery must find at least one escape at order 1 when KRACK is re-opened; with the control blinded it finds 0 and the sweep must refuse to pass", "decisive": false, "planted": [ { "path": "tools/hostapd_pqc/exhaustive_compound_closure_ci.py", "diff": "'control_cfg = dataclasses.replace(full, idempotent_install=False)' -> 'control_cfg = dataclasses.replace(full, idempotent_install=True)' (x1 of 1)" } ], "exit": 2, "seconds": 204.5, "last_line": "make: *** [unseeded-hunt] Error 1", "failure_moved_by": null } ], "measured": true, "stale_claims_ref": null }, "packet": null, "measured": { "measured": true, "basis": "planted_defects[].exit = 2", "exit": 2, "defect_rejected": true }, "register": { "truth_state": "attested", "truth_line": 182, "measured_per_register": false, "witness_class_per_register": "ASSERTING", "ip_class_public": "unknown", "ip_class_sha256": "b23a6a8439c0dde5515893e7c90c1e3233b8616e634470f20dc4928bcf3609bc", "ip_class_source": "TOP_N_CROWN_JEWELS.md:72 @ c5f34eda4cc9", "receipt": "register/CROWN_JEWELS_TRUTH.md", "receipt_sha256": "79ca50c3472bae4ebd179ed533456325be8e0e9027739787bfba9f06442fc39b", "ip_class_receipt": "register/ip_class.jsonl", "ip_class_receipt_sha256": "1cd70f508c6b79f941e894144715088f18fcd31092e56e98a4cf6be526d9e724" }, "withheld_fields": [ { "field": "top40.portfolio_id", "codes": [ "LANE_DIRECTORY_NAME" ] }, { "field": "witness_quality.portfolio_id", "codes": [ "LANE_DIRECTORY_NAME" ] }, { "field": "attestation_row.repository", "codes": [ "LANE_DIRECTORY_NAME" ] } ], "sources": { "attestation": { "receipt": "wireless-pqc/dataroom/TOP_N_ATTESTATION.jsonl", "source": "dataroom/TOP_N_ATTESTATION.jsonl", "commit": "c5f34eda4cc9f7f86308a5db1cfa75efcd4c6841", "sha256": "cf3ea9a5f950428ca05e7d6678bf2e529c0265fb250c8fc0c91a4049d06ff2d4", "bytes": 3364, "visibility": "sealed" }, "top40": { "receipt": "wireless-pqc/dataroom/top40.json", "source": "dataroom/top40.json", "commit": "c5f34eda4cc9f7f86308a5db1cfa75efcd4c6841", "sha256": "5b765e618185384adc31381c60605ec146bb0f0c1c7352424a8929d2c0d98f14", "bytes": 196287, "visibility": "sealed" }, "witness_quality": { "receipt": "wireless-pqc/dataroom/witness_quality.json", "source": "dataroom/witness_quality.json", "commit": "c5f34eda4cc9f7f86308a5db1cfa75efcd4c6841", "sha256": "ad621a72648f0d2b485d163eccc92082ac3f36cb731c7b5bca8103983a157bd7", "bytes": 180480, "visibility": "sealed" }, "repro_index": { "receipt": "wireless-pqc/repro/INDEX.json", "source": "repro/INDEX.json", "commit": "c5f34eda4cc9f7f86308a5db1cfa75efcd4c6841", "sha256": "378fd4a3ce4f44403b7c9ca6a3f19c11895831f892736376c90cf9423037f9eb", "bytes": 26512, "visibility": "sealed" } } }