zooqueen
9bab8ee852
Freeze ONE release, prove that exact release under stated assumptions:
releases/2026-06-pq-threshold-stack/
RELEASE-MANIFEST.toml pins every repo at an exact commit + version
CLAIMS.md the claim matrix: PULSAR/CORONA/MAGNETAR/P3Q/
QUASAR -C1..C7, each with evidence class +
assumptions + status; the open Bucket-C
(reconstruct-then-sign) assumptions; the merge
rule; the precise allowed wording.
EXTERNAL-REVIEW-SIGNOFF.md reviewers sign claim IDs, not "looks good".
framework/prove-release.sh the "once and for all" command: runs the gate +
tests + red-team PoCs over the pinned manifest,
emits gate-results.json + PASS/FAIL.
Honest status: review-ready candidate. All axioms discharged, bridged, or
disclosed; open security assumptions remain external-review blockers. No
"fully proven" / "production-certified" until EXTERNAL-REVIEW-SIGNOFF is signed.
2.0 KiB
External Cryptographic Review — Sign-off
Reviewers sign claim IDs, not "looks good". One signed form per reviewer.
Scope is fixed to the commits in RELEASE-MANIFEST.toml and the claim IDs in
CLAIMS.md. The release may not be called externally reviewed — and no
"production-certified" or "fully-proven" language may be used — until at least
the required reviewers have signed and every CRITICAL/HIGH open finding is
accepted, waived, or closed.
Request to the reviewer
Please review the claims listed in CLAIMS.md for this release. For each
claim ID, mark exactly one verdict:
accepted— the evidence supports the claim as stated.accepted-under-assumption— supported given the named Bucket-C assumption(s).rejected— the evidence does not support the claim.insufficient-evidence— cannot conclude; state what is missing.
Pay particular attention to the OPEN Bucket-C assumptions
(AXIOM-INVENTORY.md / .assurance/reviewed-axioms.txt), especially the
reconstruct-then-sign EC axioms (combine_body_axiom, S_functional_spec, …):
confirm they are the minimal, correct assumption set and that no theorem
labelled "proven" silently depends on an undischarged one.
Sign-off form
Reviewer:
Affiliation:
Scope (commit hashes from RELEASE-MANIFEST.toml):
Claim IDs reviewed:
accepted:
accepted-under-assumption: (list assumption IDs)
rejected:
insufficient-evidence:
Open findings (id · severity · summary):
Waived findings (id · rationale):
Conclusion:
Signature / date:
Required reviewers (this release)
- Lattice threshold (Pulsar + Corona) — applied-lattice cryptographer
- Hash-based threshold (Magnetar) — SLH-DSA / hash-based-signature reviewer
- STARK/FRI soundness (P3Q + quorum-cert predicate) — ZK/STARK reviewer
Signed forms are committed here as signoff-<reviewer>.md and hashed into
ASSURANCE.lock. Only then does RELEASE-MANIFEST.toml status move to
released and the stronger claim language in CLAIMS.md §wording unlock.