<div style="font-family: Arial, sans-serif; font-size: 14px;">Hey Metzdowd, I've prepared the following for everyone: </div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span></span><div><span>== What SIGIL is (the short version, before the crypto) ==</span></div><div><br></div><div><span>SIGIL is a live experimental DagKnight chain (network sigil-g0, height ~29M</span></div><div><span>under accelerated laboratory economics) built on a simple conviction: money's</span></div><div><span>ledger should be checkable rather than taken on faith, and every binary that</span></div><div><span>runs the network should prove its own origin. Bitcoin proved a network can agree</span></div><div><span>on a supply no one can quietly inflate -- but deliberately left out</span></div><div><span>expressiveness, and, like every widely deployed chain, runs on elliptic-curve</span></div><div><span>signatures a large quantum computer would break. Ethereum added the</span></div><div><span>expressiveness and already commits state, transaction and receipt roots in every</span></div><div><span>execution header -- but it fixes no 21M-style monetary policy, puts no post-</span></div><div><span>quantum floor under its signatures, and offers no protocol-level provenance for</span></div><div><span>the client binaries that run it; it is pre-quantum underneath too. SIGIL's brief is to keep what they got right</span></div><div><span>(capped honest money, programmability) and add what post-quantum cryptography</span></div><div><span>and a self-signing compiler now make possible: four sparse-Merkle state roots in</span></div><div><span>every header (a node that drifts on any of them halts itself before serving a</span></div><div><span>byte), a compiler-emitted post-quantum provenance proof binding each release</span></div><div><span>binary to its build, a programmable economy (a contract VM, a constant-product</span></div><div><span>AMM DEX, on-chain credit, and an experimental Bitcoin SPV deposit verifier --</span></div><div><span>it checks an SPV proof + PoW finality, NOT yet a complete trustless bridge; BTC</span></div><div><span>custody and peg-out are not trustless yet) riding inside that same structural</span></div><div><span>guarantee, and tip verification cheap enough that a browser frame -- or honestly,</span></div><div><span>a potato -- can hold the chain to account.</span></div><div><br></div><div><span>This email leads with what is MEASURED, keeps simulation results labeled as</span></div><div><span>simulation, and closes with what is still open. Three numbers set the tone, each</span></div><div><span>reproducible from section 4:</span></div><div><br></div><div><span> - One constant-size proof for the whole chain: 2,568 bytes regardless of</span></div><div><span> length, full verification 342 ms at the 100k-block benchmark, and a</span></div><div><span> 3-microsecond incremental tip check on the live 29M-block network. (Two</span></div><div><span> separate measurements, two lanes -- NOT one pipeline; the honest nuance is</span></div><div><span> in section 0.)</span></div><div><span> - One closed-form law for the gossip layer: delivery D(p,r) = 1 - p^r,</span></div><div><span> validated against 22 seeded deterministic simulations, RMS residual 0.4</span></div><div><span> percentage points -- and inverted into the provisioning rule the network</span></div><div><span> actually ships with (r = 3 clears a 99.9% SLA up to p = 0.1).</span></div><div><span> - Zero divergence across a six-scenario adversarial ordering gate (multi-</span></div><div><span> producer braid: 30% drop/reorder/equivocation, withheld blocks, 16/16</span></div><div><span> orderings agree, tamper suite 5/5 rejected) before the live producer</span></div><div><span> flipped to the braid binary -- stress-test evidence, not a theorem, and we</span></div><div><span> say which out loud.</span></div><div><br></div><div><span>One methodological result worth this list's time even if the chain is not: the</span></div><div><span>project's Rule 0, learned at cost. Our local sync pipeline stages benchmarked at</span></div><div><span>251k-2.5M blocks/s while the LIVE sync number sat at ~800 blocks/s for five</span></div><div><span>days. The wall was never the pipeline -- it was a producer-side serve throttle</span></div><div><span>and a serial fetch loop, found only when we measured the deployed path directly;</span></div><div><span>removing them moved the live number 2,322 -> 10,853 blocks/s on the running</span></div><div><span>node. A fast microbenchmark next to a slow live number is a bug report about</span></div><div><span>your understanding, not a victory. Every figure in this email names which side</span></div><div><span>of that line it sits on.</span></div><div><br></div><div><span>Honesty up front (the whitepaper carries this as a boxed disclosure, so the</span></div><div><span>email should too). First, decentralization: sigil-g0 is a SINGLE-PRODUCER,</span></div><div><span>permissioned testnet today -- one block producer (the operator's node), one</span></div><div><span>operator, minimal peers. The operator can reset or rewrite the chain; external</span></div><div><span>miners submit dual-lane shares to that one producer and do NOT independently</span></div><div><span>produce or order blocks yet. There is no genesis allocation and no sale, but</span></div><div><span>single-operator production means the operator has necessarily controlled most of</span></div><div><span>the emitted supply (the treasury and the 1.2% commons quorum are operator-held),</span></div><div><span>and every testnet balance is discarded before mainnet. A permissionless multi-</span></div><div><span>producer mesh is the next milestone -- do not read the multi-producer braid</span></div><div><span>simulations below as a decentralized network. Second, authentication: sigil-g0's</span></div><div><span>RPC money routes ARE authenticated (per-wallet ed25519 signature + monotonic</span></div><div><span>nonce; the 2026-06 audit's theft findings are fixed and enforcing). The residual risk is deeper: block-apply does not yet</span></div><div><span>enforce the producer's signature (H1 -- a height-gated verifier is written,</span></div><div><span>tested, dormant), the live VDF still runs over a forgeable fixed modulus while</span></div><div><span>its trustless replacement sits unwired (C10), and peer-sync ingress is</span></div><div><span>under-authenticated (H2/H3/H4; the first H2 gate -- a real ed25519</span></div><div><span>verify-before-sync handshake with channel binding on the block-serve path --</span></div><div><span>landed on the hardening branch in log-only mode). Tracked with file:line in the</span></div><div><span>public hardening backlog. Do not route significant value through SIGIL until</span></div><div><span>they close. [V: re-state H2 status at posting -- branch-only today.]</span></div><div><br></div><div><span>== 0. The crypto, up front (everything below is reproducible; URLs in section 4) ==</span></div><div><br></div><div><span> - Hybrid provenance signatures, require-both: a composite of SQIsign</span></div><div><span> (post-quantum isogeny; sqisign-rs 0.3; targeting NIST Level 5 -- SQIsign is</span></div><div><span> a candidate in NIST's additional-signatures on-ramp, NOT a standardized</span></div><div><span> scheme; 292-byte sig / 129-byte pk) AND Ed25519 (64-byte sig / 32-byte pk):</span></div><div><span> a ~356-byte signature, smaller than a single ML-DSA-87 (Dilithium-5)</span></div><div><span> signature at 4595 B. The verifier requires EVERY leg in a fixed scheme-set</span></div><div><span> to validate -- no single-leg downgrade -- so a break in either family does</span></div><div><span> not forge a binary. This is defense-in-depth against the youngest PQ family</span></div><div><span> (sqisign-rs is 0.x; a sibling, SIDH/SIKE, fell in 2022), with Ed25519 as a</span></div><div><span> classical belt; its security rests on strict domain separation and</span></div><div><span> require-both verification, NOT a published proof -- combiner analysis is</span></div><div><span> ongoing and review is invited. The fair PQ-only size comparison is the</span></div><div><span> 292-byte SQIsign leg alone vs 4595 B; Ed25519 adds classical, not</span></div><div><span> post-quantum, security. This is OUT-OF-BAND release provenance verified once</span></div><div><span> at update time -- NOT in the per-tx auth or sync path, so it cannot regress</span></div><div><span> throughput. (A third lattice leg, ML-DSA-87, slots into the same container</span></div><div><span> for root keys wanting isogeny-AND-lattice diversity.) [V: artifacts carry</span></div><div><span> non-empty SQIsign AND Ed25519 fields; a single-leg bundle is REJECTED, not</span></div><div><span> downgraded; the proof hash is committed in-header.]</span></div><div><br></div><div><span> - flux-sigil: a streaming BLAKE3 hasher that signs its own digest with the</span></div><div><span> SQIsign L5 key on finalize -- sign-on-finalize, NOT BLAKE3 keyed-hashing</span></div><div><span> (the output is digest || signature, a signature over the hash, not a MAC).</span></div><div><span> Hash and authenticate in one pass.</span></div><div><br></div><div><span> - Four sparse-Merkle state roots per block (wallet, dex, event log, contract</span></div><div><span> storage). A node that drifts on any root diverges on the header and HALTS</span></div><div><span> itself (exit 78) before it serves a byte. State divergence cannot hide.</span></div><div><br></div><div><span> - flux-fold: a transparent, post-quantum folding construction over Ajtai/SIS</span></div><div><span> lattice commitments (NO trusted setup) that folds N block commitments into</span></div><div><span> one compact proof. Ajtai/SIS is the hardness assumption, not the protocol</span></div><div><span> -- the folding construction is our own and unpublished; independent review</span></div><div><span> of it and its Fiat-Shamir transcript is invited. Measured, reproducible</span></div><div><span> (flux-fold's fold-verify-bench): N=100k blocks -> 2,568-byte proof,</span></div><div><span> 280-342 ms full verification across runs on a loaded 48-core host. The</span></div><div><span> honest nuance the benchmark surfaced: the PROOF is constant-size</span></div><div><span> (independent of chain length) but full verification is O(M) -- the verifier</span></div><div><span> reads all M commitments (~51 MB at 100k blocks) to recompute the random</span></div><div><span> linear combination. Constant-size proof, NOT constant-cost verification;</span></div><div><span> the steady state is cheap because of the incremental lane: a 3-microsecond</span></div><div><span> live tip check against an already-verified fold state, 0 blocks downloaded,</span></div><div><span> running today on the 29M-block network. (Two lanes, two experiments; full</span></div><div><span> verification of the live 29M fold has not been separately benchmarked, and</span></div><div><span> we deliberately do not quote chain-length-per-verify-second as throughput.)</span></div><div><span> Late join = verify one fold of the history prefix, adopt the checkpoint,</span></div><div><span> apply live -- divergence 0. The founding claim was tip verification under</span></div><div><span> 10 ms in a browser; the live incremental check beats it by three orders of</span></div><div><span> magnitude.</span></div><div><br></div><div><span> - The gossip delivery law: D(p,r) = 1 - p^r under independent per-</span></div><div><span> transmission loss p with redundancy r, inverted to the provisioning rule</span></div><div><span> r* = ceil(ln(1-SLA)/ln p). Derived and validated against 22 seeded</span></div><div><span> flux-chronos star-flood simulations, RMS residual 0.4 pp; the shipped</span></div><div><span> default r=3 satisfies a 99.9% SLA up to p=0.1. Statistical mechanics of the</span></div><div><span> gossip layer done properly: model, measurement, closed form, residual, and</span></div><div><span> a rule operators actually use. (Standalone paper: URL in section 4.)</span></div><div><br></div><div><span> - A browser tip-check in two layers: the light path recomputes the exact</span></div><div><span> BLAKE3 tip fingerprint a native node commits, 0 blocks downloaded; the PQ</span></div><div><span> path is the flux-ivc-verifier-wasm verifier (STARK + lattice) with a 10 ms</span></div><div><span> gate [V: which path ships enabled by default]. In-tab hybrid PQ key</span></div><div><span> material: Ed25519 and ML-DSA-87 for signing identity, ML-KEM-1024 for key</span></div><div><span> encapsulation (a KEM, not a signature: confidentiality, not authentication;</span></div><div><span> FIPS 204/203; the ML-DSA-87 and ML-KEM-1024 members target NIST Level 5),</span></div><div><span> full keygen ~267 ms in-browser, no wasm; ML-KEM channel establishment</span></div><div><span> measured at 115 ms browser-to-bridge.</span></div><div><br></div><div><span> - chronos: a deterministic, seeded, virtual-time harness that runs the REAL</span></div><div><span> chain code and measures the CPU-time cost of its real crypto paths. It times</span></div><div><span> actual ed25519 batch-auth (keygen + sign + verify, one signature per N-op</span></div><div><span> batch, parallel across cores) head-to-head against a zk-flux verify-once</span></div><div><span> path. The zk-flux numbers are real prove/verify times and real byte sizes,</span></div><div><span> but a COST STRUCTURE only: the lattice wrap binds the FRI-STARK commitment,</span></div><div><span> it does not yet PROVE STARK validity. A 72-hour soak resolves in seconds of</span></div><div><span> wall clock and is bit-reproducible. The delivery law's 22 validation runs</span></div><div><span> and the braid's six-scenario adversarial gate (divergence = 0 under 30%</span></div><div><span> drop/reorder/equivocation and withheld blocks; 16/16 orderings agree;</span></div><div><span> tamper suite 5/5 rejected) both ran under this harness.</span></div><div><br></div><div><span> - Time-based emission: block_reward = integral of rate over</span></div><div><span> [prev_block_ts, block_ts]; rate halves every HALVING_PERIOD = 126,144,000 s</span></div><div><span> (4 years). The first period emits exactly MAX_SUPPLY/2; the geometric sum</span></div><div><span> 2 x (MAX_SUPPLY/2) -> 21,000,000 is approached asymptotically and never</span></div><div><span> reached, and a compile-time const_assert checks the schedule sums to exactly</span></div><div><span> the cap. Invariant under block rate -- a height-based schedule breaks when</span></div><div><span> block cadence changes (we found this at 220 blk/s).</span></div><div><br></div><div><span>== What Flux is (three paragraphs) ==</span></div><div><br></div><div><span>Flux is an AI-native, self-hosting Rust build orchestrator: the tool that</span></div><div><span>compiled, tested, signed, and shipped every binary described in this email,</span></div><div><span>including itself. Mechanically it is a content-hash compile cache (~6x</span></div><div><span>intra-workspace speedup), a Kahn's-algorithm parallel batch scheduler, and a</span></div><div><span>MIR -> CLIF native-object backend for a growing subset of Rust. The</span></div><div><span>list-relevant part is not the speed. It is that Flux treats a compiled artifact</span></div><div><span>as something to be cryptographically attested at the moment it exists: every</span></div><div><span>release binary leaves the compiler carrying a `.proof` bundle that binds the</span></div><div><span>artifact's BLAKE3, the source's BLAKE3, the compiler's own version and git</span></div><div><span>commit, and the identity that built it, signed post-quantum. The compiler signs</span></div><div><span>what it builds.</span></div><div><br></div><div><span>Flux is driven by autonomous agents, not only by humans. The build / test /</span></div><div><span>optimize / release loop is exposed as a typed tool surface that AI agents call</span></div><div><span>directly; each unit of work is claimed, performed, and settled on-chain, and the</span></div><div><span>agent's settlement wallet is one of the fields inside the signed `.proof` record.</span></div><div><span>The practical consequence is that "who produced this binary, from which source,</span></div><div><span>with which compiler" stops being a trust assumption recorded in a CI log and</span></div><div><span>becomes a fact you can recompute from the artifact alone -- offline, with no</span></div><div><span>trusted server. Builds distribute across a peer-to-peer fleet; releases are</span></div><div><span>content-addressed by BLAKE3, and the updater is fail-closed (manifest verified</span></div><div><span>end-to-end, the new binary's version probed before handoff, auto-rollback after</span></div><div><span>three failed boots). Reproducibility and attribution are properties of the</span></div><div><span>primitive, not of the process wrapped around it.</span></div><div><br></div><div><span>For this list specifically, Flux is a working substrate for post-quantum</span></div><div><span>supply-chain provenance, and SIGIL is its proving ground. The signing leg is the</span></div><div><span>require-both hybrid above: SQIsign Level 5 AND Ed25519, ~356 bytes together,</span></div><div><span>smaller than a single ML-DSA-87 signature, with a downgraded single-leg bundle</span></div><div><span>rejected rather than silently accepted (section 1 gives the canonical signing</span></div><div><span>record and the honest limits). SIGIL exercises that substrate end to end: a</span></div><div><span>single static binary that is node, miner, light client, and wallet, on a chain</span></div><div><span>whose every shipped artifact, every block header, and every committed state root</span></div><div><span>is built to be self-attesting and independently checkable. The composition is</span></div><div><span>ours and unpublished; the primitives it rests on (SQIsign, Ajtai/SIS, BLAKE3,</span></div><div><span>Ed25519, the FIPS 203/204 members) are not. Cryptanalysis and review of the</span></div><div><span>composition are explicitly invited.</span></div><div><br></div><div><span>== 1. The substrate: a compiler that signs what it builds ==</span></div><div><br></div><div><span>Flux is a self-hosting Rust build orchestrator (content-hash compile cache,</span></div><div><span>~6x intra-workspace cache speedup; Kahn's-algorithm parallel batching; a</span></div><div><span>MIR -> CLIF native-object backend for a growing subset of Rust). The</span></div><div><span>list-relevant primitive: a release binary carries a `.proof` bundle whose</span></div><div><span>signing input is a canonical 177-byte record --</span></div><div><br></div><div><span> version || artifact_blake3 || source_blake3 || fluxc_version ||</span></div><div><span> fluxc_git || agent_wallet || swarm_task_id || settle_tx || timestamp_us</span></div><div><br></div><div><span>-- signed with SQIsign Level 5; verification recomputes the artifact BLAKE3,</span></div><div><span>then checks the signature. Downgraded-length signatures are rejected before</span></div><div><span>parsing (a 148-byte Level-1 sig is a hard error). Releases are content-addressed</span></div><div><span>by BLAKE3; the updater is fail-closed (manifest verified end-to-end, the new</span></div><div><span>binary's version probed before handoff, auto-rollback after three failed boots).</span></div><div><span>A require-both SQIsign-L5 + Ed25519 `.proof` is LIVE for the shipping v7.0.4</span></div><div><span>release, and its two builder-key fingerprints are published for pinning</span></div><div><span>(section 4). Honest limit: it binds the artifact and signing agent, NOT</span></div><div><span>the source -- post-build signing, because the matching tree was not cleanly</span></div><div><span>available; the compiler-emitted artifact+source binding is wired and</span></div><div><span>demonstrated, pending a cut from a current tree. [V: ship built+signed in one</span></div><div><span>pass so artifact AND source bind, proof hash committed in-header.]</span></div><div><br></div><div><span>== 2. The chain: divergence cannot hide, and money cannot drift ==</span></div><div><br></div><div><span>Every header commits four state roots; a node that drifts halts itself before</span></div><div><span>serving traffic -- the structural fix for the replay-bug class that silently</span></div><div><span>corrupted a production balance on our sister chain in May 2026. Three</span></div><div><span>independent emission guards: a compile-time const_assert that the schedule sums</span></div><div><span>exactly to the cap; a runtime commit chokepoint that refuses any post-state</span></div><div><span>above 21M base units; and a fail-loud band enforcer that compares realized</span></div><div><span>supply (read from the committed wallet root) to the deterministic target and</span></div><div><span>HALTS at +/-2% drift. A controller that mints is drift-prone; a verifier that</span></div><div><span>halts turns "three days of wrong rewards" into "halt at block 1."</span></div><div><br></div><div><span>Ordering is a DagKnight braid (sigil-dagknight + flux-topology). Before the</span></div><div><span>live producer flipped to the braid binary it passed a six-scenario adversarial</span></div><div><span>simulation gate -- multi-producer divergence 0 at 10k and 100k blocks, 30%</span></div><div><span>drop/reorder/equivocation, a withheld-block attacker with the finalized prefix</span></div><div><span>byte-identical, 16/16 ordering permutations agreeing, tamper suite 5/5 rejected</span></div><div><span>-- and a two-producer live mesh ran 3385 emissions byte-identical first.</span></div><div><span>But the LIVE network today runs a SINGLE producer (see the honesty note up top):</span></div><div><span>the braid's multi-producer results are simulation plus one bounded two-producer</span></div><div><span>mesh, not the deployed topology. Simulation convergence is encouraging evidence,</span></div><div><span>not a safety or liveness proof; the Byzantine threshold for the braid is named</span></div><div><span>open theory.</span></div><div><br></div><div><span>== 3. One binary: node + miner + wallet, on a potato ==</span></div><div><br></div><div><span>sigil-top is a single static binary (Linux + Windows): a monitoring node, a</span></div><div><span>light client, a dual-lane miner, and a wallet. Highlights, each encoding a</span></div><div><span>hard-won invariant:</span></div><div><br></div><div><span> - Light monitor by default: verifies the live tip fingerprint</span></div><div><span> fp = BLAKE3(version || len(net_id) || net_id || height</span></div><div><span> || wallet_root || dex_root || event_root || contract_root)</span></div><div><span> in ~3 microseconds with 0 blocks downloaded; a browser implementation</span></div><div><span> (vendored @noble/hashes BLAKE3) computes the identical value. Opt-in</span></div><div><span> genesis->tip sync runs at a measured LIVE 10,853 blocks/s on the running</span></div><div><span> node (up from 2,322 after removing a producer-side serve throttle + a</span></div><div><span> serial fetch loop -- the live path, not a microbenchmark; wire compression</span></div><div><span> 14.0x on the backfill codec, 70.7 B/header live). A full restart</span></div><div><span> stream-recovered ~102,000 blocks in bounded memory. [V: name the exact</span></div><div><span> run + build for the 10.8k figure at posting.]</span></div><div><br></div><div><span> - Anti-phantom sync: a peer-claimed tip may only RAISE the sync target within</span></div><div><span> a bounded lead over a signed oracle tip; store watermarks are keyed to the</span></div><div><span> genesis hash, so a testnet reset self-heals in seconds instead of leaving</span></div><div><span> clients chasing a ghost height. [V: stale-client + fresh-genesis self-heal</span></div><div><span> < 10 s acceptance test is in CI.]</span></div><div><br></div><div><span> - Bounded-RAM durability: the block store opens in O(window), never O(chain);</span></div><div><span> a write-ahead log past a sanity bound is quarantined at open, not replayed</span></div><div><span> into RAM (the fix for a Windows append-mode quirk where a 1.6 GB poisoned</span></div><div><span> WAL ate 3-4 GB of RAM at every start).</span></div><div><br></div><div><span> - Verified-identity earning: a wallet binds an identity by signing a</span></div><div><span> domain-separated nonce'd message; the wallet IS the public key. Verified</span></div><div><span> wallets earn to themselves; unverified mining routes to the treasury. A</span></div><div><span> fixed 1.2% of every reward routes to a commons pool under an M-of-N quorum</span></div><div><span> -- the cryptographic quorum is load-bearing; an LLM-debate layer above it is</span></div><div><span> policy, not consensus.</span></div><div><br></div><div><span>== 4. Testing, and how to reproduce ==</span></div><div><br></div><div><span>Two practices earned their keep. (1) Deterministic virtual time (chronos): the</span></div><div><span>harness runs the REAL chain code -- apply_tx + commit_state_transition + the</span></div><div><span>four roots -- under a simulated clock, measuring real signature-verification CPU</span></div><div><span>cost, not just network timing, benchmarking the ed25519 batch-auth path against</span></div><div><span>a zk-flux verify-once path. (2) A Stargate state-transition wind tunnel:</span></div><div><span>`parallel_exec.rs` measured 1,901,939 tx/s at 4 threads, 5,173,981 peak at 16</span></div><div><span>(4M tx, 1M accounts), the parallel commutative-merge root asserted equal to the</span></div><div><span>serial fold root at every thread count -- a wind-tunnel number, NOT testnet TPS;</span></div><div><span>DagKnight/Narwhal ordering remains a named integration lane.</span></div><div><br></div><div><span>Reproduce:</span></div><div><span> curl <a target="_blank" rel="noreferrer nofollow noopener" href="https://sigilgraph.fluxapp.xyz/sigil-status.json">https://sigilgraph.fluxapp.xyz/sigil-status.json</a> (live feed)</span></div><div><span> curl <a target="_blank" rel="noreferrer nofollow noopener" href="https://sigilgraph.fluxapp.xyz/sigil-tip-live.json">https://sigilgraph.fluxapp.xyz/sigil-tip-live.json</a> (live tip)</span></div><div><span> <a target="_blank" rel="noreferrer nofollow noopener" href="https://sigilgraph.fluxapp.xyz/downloads/sigil-top-latest.json">https://sigilgraph.fluxapp.xyz/downloads/sigil-top-latest.json</a> (BLAKE3</span></div><div><span> content-addressed manifest; Linux x86_64 + Windows x64)</span></div><div><span> <a target="_blank" rel="noreferrer nofollow noopener" href="https://sigilgraph.fluxapp.xyz/downloads/sigil-top-v7.0.4-linux-x64">https://sigilgraph.fluxapp.xyz/downloads/sigil-top-v7.0.4-linux-x64</a> (the</span></div><div><span> binary the proof below attests; verified 200, 13,819,984 B)</span></div><div><span> <a target="_blank" rel="noreferrer nofollow noopener" href="https://sigilgraph.fluxapp.xyz/downloads/sigil-top-v7.0.4-linux-x64.proof">https://sigilgraph.fluxapp.xyz/downloads/sigil-top-v7.0.4-linux-x64.proof</a> (LIVE</span></div><div><span> require-both SQIsign-L5 + Ed25519 hybrid proof, 6002 B; sqisign_pubkey 129 B</span></div><div><span> + sqisign_sig 292 B + ed25519_pubkey 32 B + ed25519_sig 64 B. Recompute</span></div><div><span> BLAKE3 of the binary above -- it equals the proof's artifact_hash</span></div><div><span> 413807bd55ccbf4b7fe0acc19879b52d57e2c32cb49bd9e8ff6879163135314a</span></div><div><span> (re-verified with b3sum this pass) -- then run</span></div><div><span> `fluxc verify-proof <bin> <bin>.proof`, which checks the artifact BLAKE3</span></div><div><span> AND both signatures over the canonical record; a stripped single-leg</span></div><div><span> bundle is rejected.)</span></div><div><span> <a target="_blank" rel="noreferrer nofollow noopener" href="https://sigilgraph.fluxapp.xyz/downloads/sigil-builder-keys.json">https://sigilgraph.fluxapp.xyz/downloads/sigil-builder-keys.json</a> (the PINNED</span></div><div><span> builder keys -- the step this list will care about most. A self-consistent</span></div><div><span> proof signed by the WRONG keys is still a forgery, so after verify-proof</span></div><div><span> passes, compare the proof's builder keys to these pinned fingerprints:</span></div><div><span> SQIsign-L5 pubkey BLAKE3</span></div><div><span> 02b8b38c5f168758757a5f81a33c257f16e482c313aec08c0b5bbc3afac57e09, Ed25519</span></div><div><span> pubkey BLAKE3</span></div><div><span> 6e0128278d97d793546d76da2bb6d69d053e4308d2d4680962953280fd72c563.)</span></div><div><span> <a target="_blank" rel="noreferrer nofollow noopener" href="https://quillon.xyz/downloads/sigil-top-delivery-law.pdf">https://quillon.xyz/downloads/sigil-top-delivery-law.pdf</a> (the delivery-</span></div><div><span> law paper: derivation, 22 seeded runs, residuals)</span></div><div><span> <a target="_blank" rel="noreferrer nofollow noopener" href="https://quillon.xyz/downloads/sigil-whitepaper-v1.pdf">https://quillon.xyz/downloads/sigil-whitepaper-v1.pdf</a> (the v1</span></div><div><span> whitepaper: the master equation, measured laws, honest-status ladder;</span></div><div><span> mirror at sigilgraph.fluxapp.xyz/downloads/sigil-whitepaper-v1.pdf)</span></div><div><span> The browser node verifies the tip fingerprint in front of you.</span></div><div><span> Source: <a target="_blank" rel="noreferrer nofollow noopener" href="https://github.com/deme-plata/sigilgraph">https://github.com/deme-plata/sigilgraph</a></span></div><div> Flux it self: <a target="_blank" rel="noreferrer nofollow noopener" href="https://github.com/deme-plata/sigilgraph" style="scrollbar-width: thin; scrollbar-color: rgba(0, 0, 0, 0.35) rgba(0, 0, 0, 0); color: blue; background-color: rgb(255, 255, 255);">https://</a>fluxapp.xyz</div><div><span> Reporting: non-sensitive findings -> public issues on that repo; security-</span></div><div><span> sensitive findings -> GitHub private vulnerability reporting, or email</span></div><div><span> <a target="_blank" rel="noreferrer nofollow noopener" href="mailto:bitknight.dipper688@passmail.net">bitknight.dipper688@passmail.net</a> (ask for a PGP key to encrypt).</span></div><div><br></div><div><span>Reference machine + method: throughput and soak figures are single-box on the</span></div><div><span>public testnet node; the SQIsign / ed25519 / zk-flux cost numbers come from the</span></div><div><span>named crate benches and the sigil-chronos bins; the fold verification range is</span></div><div><span>280-342 ms across runs on a loaded 48-core host (fold-verify-bench in</span></div><div><span>flux-fold); the ~267 ms hybrid keygen is an in-browser consumer-hardware</span></div><div><span>figure; the ~3 us fingerprint is the native light-path figure. [V: pin the</span></div><div><span>exact CPU / RAM / OS / browser strings at posting -- "consumer hardware" and</span></div><div><span>"the testnet node" are not measurements.]</span></div><div> </div><div><br></div><div><span> - chronos benchmarks the ed25519 auth path and a zk-flux cost structure; it</span></div><div><span> is not a cryptanalysis harness. SQIsign-L5 secures provenance and one</span></div><div><span> tip-proof flavor, NOT the per-tx batch-auth.</span></div><div><span> - The require-both hybrid is LIVE: each leg signs a domain-separated digest</span></div><div><span> binding the (scheme, public-key) set; a single-leg bundle is rejected, never</span></div><div><span> downgraded. It is additive -- it touches neither the SQIsign surface nor the</span></div><div><span> ed25519 batch-auth path, so throughput stands. Two limits: it binds</span></div><div><span> artifact + agent, NOT source (post-build signing; current-tree cut pending),</span></div><div><span> and in-header commitment of the proof hash is the v1.0 target.</span></div><div><span> - flux-fold: constant-size proof (2,568 B), NOT constant-cost verification --</span></div><div><span> full verify is O(M) in commitments read (~51 MB at 100k blocks); 280-342 ms</span></div><div><span> is a measured range at the 100k benchmark, not an asymptotic bound, and the</span></div><div><span> live 29M fold has not been full-verified as a separate benchmark. Soundness</span></div><div><span> rests on Ajtai/SIS -- review of the construction and its Fiat-Shamir</span></div><div><span> transcript is welcome. zk-flux's lattice wrap binds but does not yet prove</span></div><div><span> STARK validity (cost-structure, not soundness).</span></div><div><span> - The braid's divergence-0 record is simulation-gated + one live two-producer</span></div><div><span> mesh; it is not a Byzantine safety/liveness proof.</span></div><div><span> - The ~2M / ~5.17M Stargate numbers are state-transition harness numbers,</span></div><div><span> excluding mempool, storage, p2p, and DagKnight ordering -- not production</span></div><div><span> throughput.</span></div><div><span> - Consensus-layer hardening in flight, tracked publicly with file:line:</span></div><div><span> block-apply producer-sig (H1: verifier written + height-gated, dormant),</span></div><div><span> trustless VDF modulus (C10: built, unwired), peer-sync ingress auth</span></div><div><span> (H2: real ed25519 verify-before-sync handshake with per-peer channel</span></div><div><span> binding landed on the hardening branch, log-only pending fleet telemetry;</span></div><div><span> H3 follower difficulty + H4 wire tip-proofs open).</span></div><div><span> - The @noble PQ hybrid composition (Ed25519 + ML-DSA-87 + ML-KEM-1024) is ours</span></div><div><span> and worth independent eyes; "NIST L5" describes the PQ members, not the</span></div><div><span> composition. The testnet runs two chains by design (verify-once throughput +</span></div><div><span> dual-lane mined rewards); each number above names its chain.</span></div><div><br></div><div><span>Cryptanalysis on the tip-proof construction, the fold scheme, the time-based</span></div><div><span>emission integral (especially boundary behavior at halving edges and the</span></div><div><span>remainder-carry), the SQIsign provenance binding, and the PQ hybrid composition</span></div><div><span>is explicitly invited.</span></div><div><br></div><span>-- Viktor Sandstrøm Kristensen</span><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><span><br></span></div>
<div style="font-family: Arial, sans-serif; font-size: 14px;" class="protonmail_signature_block ">
<div class="protonmail_signature_block-user "><div>Really important if something matters<br></div></div>
<div class="protonmail_signature_block-proton">
Afsendt med <a href="https://proton.me/mail/home" target="_blank">Proton Mail</a> sikker e-mail.
</div>
</div>