charon v0.1: the ferry log — every verdict re-derived from bytes, chained, and attacked before it was announced

[fathomlab]

charon v0.1: the ferry log — the lab's record over three formats, re-derived from bytes, chained, and attacked before it was announced

Stacked on #59 (base: feat/sworn-v02-next-level). Spec committed before the module; module; adversarial pass; repairs; log rebuilt; RESULT re-sworn against it.

What Charon is

styxx/charon.py — the log of crossings. Every line is a verdict re-derived from bytes by one of the three verifiers the lab already has: a sworn document at the commit its sidecar names (styxx.sworn), a capsule (styxx.capsule), an OATH certificate with its receipts (styxx.corpus_audit → styxx.certify). Charon reproduces; it never adjudicates, accuses no one, fetches nothing, signs nothing.

• The receipt set is on every line, and the kind says what it means. 10 of 227 held-class lines rest on ten or more receipts (max 21): 8 OATH certificates, where a larger set makes HELD strictly easier, and 2 sworn documents, where the author named the leaf and volume buys nothing.
• SKEW is not DRIFT. verify separates a core that moved with the instrument's bytes from one that moved under the same build, beside MOVED_VERIFIER, UNRESOLVED, HEAD_MISMATCH and TAMPER. verifier.modules carries the whole derivation path, Charon included.
• The log: 243 lines — 213 certificates (every tracked one; the arXiv staging copies enter as UNRESOLVED lines, not absences), 18 sworn, 12 capsules. Head bcffbebc…. SAME_LINE 243, TAMPER 0 — a determinism check, not a stability result. The population is papers/charon/build_log.py, not a sentence.

The adversarial pass — run before any announcement

papers/charon/ATTACKS_charon_v01_battery_2026_09_02.md: three attackers, three lenses. Four sentences the instrument published about itself were false, and are repaired:

1. "A line cannot be removed or reordered without the chain saying so." A forger who rebuilds seq/prev/entry_id produces a chain that checks. The chain binds order to the head → --expect-head, HEAD_MISMATCH, and a report that says so without one.
2. "Every line is a verdict re-derived from bytes." Capsule verdicts were copied from the embedded record. Both kinds now carry the live re-derivation; a test forges an embedded verdict and asserts it never reaches the line.
3. "verify re-derives every line." It compared a class. It now compares the whole core and reports fields_changed, subject_moved, receipts_moved. REPRODUCED → SAME_LINE.
4. "A moved verifier reads as SKEW." It saw one file of several on the derivation path.

Also repaired: chained header; refused headerless ingest; malformed lines as TAMPER not tracebacks; no absolute paths; refused missing log; resolved-vs-cited receipts; reproduced via styxx.sworn.verify_receipt; vacuous HELD excluded; a derive subcommand the page prints on every row. Unrepaired attacks are named with what the instrument prints instead.

What the log found

Seven lines record an artifact that did not reproduce at ingest or had nothing to reproduce against — each with its reason on the line:

• arxiv/read_neq_write/source.md re-certifies OATH-FAILED where its certificate recorded OATH-HELD, with every byte and receipt digest matching. The verifier moved. This is the canonical arXiv/Zenodo submission source and it sits outside the directory REPLICATIONS.md runs the corpus audit over, which is why no audit reached it.
• the universal-mind capstone, certified over a changed and therefore incomplete receipt set;
• the black-box sycophancy finding, whose verdict class moved with no receipt missing;
• the handoff capsule, whose tests_pass explanation string grew when the evidence channel shipped;
• three arXiv staging certificates whose document was renamed at submission.

Two repairs outside charon

• styxx.capsule: layer 2 compares verdict classes, not strings. The v0.13 UNCOVERED band appends , N uncovered — a coverage report, not a verdict change — and six sound capsules read as failures. A class change still fails; the string difference is advisory. This also unblocks scripts/zenodo_capsule_arc.py, which refused to deposit on exactly those four capsules.
• styxx.sworn: GitTree._index sizes with --batch-check and streams. Reading every blob of a tree into one buffer per commit grew a re-derivation to 13 GB and died.

Verification

• full suite: 4509 passed, 11 skipped, 4 xfailed (1 deselected: the local-only release-caveat guard that scans gitignored bundles; green on CI)
• tests/test_charon.py 27, tests/test_capsule_uncovered_suffix.py 3, ruff clean on every touched file

Corrected in place, and how. This line said 22 until we gated this PR body against its own diff
(python -m styxx.diffgate pr60_body.md --repo . --base feat/sworn-v02-next-level --head feat/charon-v01).
The gate extracted 2 checkable claims from 63 sentences and verified both; it could not check this
one, because a test count in this shape is outside its closed template set. But its unparsed_claims
band flagged the sentence as claim-shaped, we counted by hand, and it was wrong: 27, not 22. That is the
extraction hole this lab has measured at 0.23 and 0.16 precision, reproduced on our own prose in the
hour we shipped it — and it is the argument for sworn output, where the author binds the number instead
of hoping a reader's parser finds it.

• RESULT re-sworn at 16e30ef: 26 spans, SWORN-HELD

Also in this branch

papers/closed-model-frontier/DESIGN_provenance_law_2026_09_02.md (sworn): leg 4 of the plan — 12 gates, 4096 combinations, 12 named verdicts, every gate with a power basis, contaminated prior cited by digest. Licenses nothing until signed.

What it does not say

That any verdict is true. Who wrote any line. That a rebuilt or truncated log is detectable without a head pinned outside it. That receipt shopping is prevented — it is printed. That anything is immutable or tamper-proof. Thirty-four *.seal.json artifacts have no deriver and appear on no line. The attacker was the builder.

🤖 Generated with Claude Code