Independent review triage — v2 work in progress

DeepSeek NSM/CBOR review — 2026-09-09

Full response: deepseek-nsm-cbor.md. Pi/OpenRouter ran deepseek/deepseek-v4-pro with tools disabled on the frozen review snapshot: 22,750 input tokens, 23,548 output tokens (20,714 reasoning), reported cost $0.062187944868. It reported no high/critical finding. Its five proposed issues were checked against the actual locked dependencies and request path:

• 1, noncanonical CBOR: not reproduced; contradicted by the locked encoder. serde_cbor 0.11.2 ser.rs::write_u64 recursively selects the smallest width; integer values do not retain a wider Serde type hint. Concrete Value strings, arrays and maps carry their lengths; ordered maps use canonical key order. The independent byte-vector test and cross-language cbor2.dumps(..., canonical=True) equality checks pass for the actual small and 10 MiB recovered records, including nested arrays/maps and timestamps. Hypothetical future dependency changes are not a reproduction against this Cargo.lock. This format contains no floats, so alternate NaN/float encodings are irrelevant.
• 2, record nonce OS RNG: acknowledged design choice, not a secret-source gap. Record nonces are public, and OS randomness is explicitly reseeded from NSM before any record can be produced. Direct NSM is mandatory for signing keys, epoch keys and private puzzle seeds. Nonces need not be erased. An OS RNG failure cannot bypass the boot gate or release a successfully acknowledged response; it aborts the operation. No all-random-bytes-direct-NSM claim is made.
• 3, ioctl encoding: current ABI matches the pinned upstream helper. Upstream uses request_code_readwrite!(0x0a, 0, size_of::<NsmMessage>()); two Linux aarch64 iovecs total 32 bytes, yielding 0xc0200a00. Linux asm-generic read/write bits are 2/1, not the review's proposed kernel/userspace mismatch. A future incompatible kernel is not silently supported. Real Nitro syscall validation remains a deployment gate; no successful local mock proves it.
• 4, no admission backpressure: contradicted by dispatch ordering. state.requests.try_acquire() precedes the uncached NSM call and the permit remains held through publication. Admission is bounded (configured maximum 16); NSM contention remains an availability concern under the open-service model. The suggested cached timestamp would weaken exact epoch expiry and is rejected. No guarantee of availability against flooding is claimed.
• 5, signing-key feature: enabled already. ed25519-dalek 2.x is built with default features, which include zeroize; its SigningKey::drop wipes the secret key. Cargo.lock is not the feature-resolution proof suggested by the review. This does not claim all compiler, kernel or hardware copies are erased, and enclave teardown remains within the trusted Nitro boundary.

This review adds independent scrutiny; it is not a certification. A separate Astra review requested by the user is running before replacement deployment.

The complete Pi/OpenRouter review outputs are retained alongside this file. The initial DeepSeek review read an evolving tree; it is evidence of independent scrutiny, not a certification or proof of security. Each claim is checked against code, cryptographic assumptions, and tests.

DeepSeek design review

• C1 / C2 / L3 — calibration and availability: Accepted requirement to measure real Graviton5 single-worker and seven-worker throughput under load. Production config now uses the measured 43,768,124 iterations per segment. One-day warm-up and stop-on-missed-epoch are explicit design requirements. Approximate RandomX sequential work is not a proven VDF or seven-day lower bound against faster hardware. Review's statement that parallel generation works only in the first epoch is unsupported: the next seven independent seeds use the same seven worker slots while the remaining cores serve traffic.
• C3 — GET transport: Latency/throughput benchmark remains required. Retry, truncation, duplicate, sequence, cancellation and capacity checks are covered by host/Python tests. A malicious host can corrupt or replay ciphertext but TLS authentication/record sequencing detects it; host bookkeeping is not the cryptographic trust boundary. Review arithmetic 1MiB/32KiB=64 is incorrect (it is 32). No throughput claim is made yet.
• C4 — Cloudflare: The proposed attack is invalid for the verifying client. The client runs TLS itself via MemoryBIO and verifies the actual inner peer SPKI against nonce-fresh Nitro attestation, on the same connection, before any upstream request. Proxying that attestation through a different TLS key fails. Existing synthetic PKI and actual TLS integration tests exercise this. A fetch-only LLM cannot compute inner TLS or verify COSE unaided; that limitation is retained explicitly, not hidden by a plaintext fallback.
• C5 — daily keys: Known plaintext does not compromise XChaCha20-Poly1305. Epoch-wide key recovery is intended. Key loss after enclave termination does not destroy published history: the published chained puzzle recovers that exact key. Independent ARM and x86 native recovery has passed. Daily activation gives ~7 days from publication, ~6 days for the last records, not the old per-request seven-day guarantee.
• H1 — denial of service: Bounded-resource admission cannot guarantee availability against anonymous clients. This is an accepted residual risk of the requested open service. Unpredictable client-generated 256-bit session IDs prevent guessing ordinary sessions; chosen all-zero IDs confer no privilege.
• H2 — hardware: Real Nitro validation remains required. TLS checks the hardcoded AWS hostname against trusted roots inside the enclave; controlling DNS does not forge such a connection, so hardcoded IPs are unnecessary. PCR4 binds the parent ID; live DescribeInstances and local V3 MIDR checks both gate readiness. AWS itself remains trusted. Unit checks include AWS published PCR4 and independent botocore SigV4 vectors; actual parent MIDR has matched.
• H3 — native safety: Upstream version/commit/source digests and known-answer tests are in place. Native full-mode known-answer tests have passed on Graviton5; seven-worker full-mode calibration and cross-architecture recovery have also passed. These checks do not constitute a general native memory-safety proof.
• H4 / M4 — corruption: Each wrapped next seed is authenticated separately, so a bad segment is detected at its boundary, not only after the last segment. Checkpoints have manifest-bound coordinates and a corruption checksum. They are untrusted progress hints; final AEAD/commitment validation determines correctness. They do not prove the solver performed previous work.
• M2 / M3 / L5 — implementation scope: A distinct new enclave binary and Python packages preserve the existing deployed legacy service. Old reviews, PCRs, and README claims do not prove the new code. Final docs will identify the actual v2 measurements and protocol; no migration deletes previous artifacts.
• M5 — solver incentives: The user explicitly requested operating an external solver fleet. Anyone else can solve independently. No voluntary-compute incentive is assumed for the operator's service.

Remaining gates: full implementation reviews, archive binding, real Nitro and Cloudflare operation, calibrated generation/solving, reproducible ARM EIFs, independent artifact replicas, PyPI publication, and sustained pipeline tests.

Qwen3-Coder-Next implementation review (Pi/OpenRouter)

Full answer: qwen-implementation.md; 35,732 input and 1,884 output tokens, reported model cost $0.00579504. The review contained useful edge cases but also incorrect critical claims; no claim is adopted without checking the code.

• 1 (key persistence): rejected. The public puzzle already wraps the epoch key. Saving that key in plaintext to the hostile parent would violate the design. Independent ARM and x86 native solvers have recovered the same actual recorded response without receiving its key; the repeatable integration test also terminates its enclave before solving. Crash before activation has no accepted traffic under that candidate key.
• 2 (upstream TLS): rejected. Dialer uses rustls root certificates and a validated server name, then completes the handshake before HTTP. It does not accept arbitrary certificates. Pinning every arbitrary internet destination is neither required by WebPKI nor a supported open-relay abstraction.
• 3 (host hotplugs different silicon): not an available host capability in the stated Nitro trust model. Local CPU identity, NSM parent binding and live AWS instance evidence gate startup. Stopping/resizing the parent terminates its enclave. AWS itself remains trusted; this is not a claim against malicious AWS.
• 4 (client nonce reuse): rejected as a server defect. The client generates a new cryptographic 32-byte nonce each verification. The server accepting the same externally chosen nonce does not weaken a verifier that makes fresh challenges; an attacker-chosen nonce is not the honest client's challenge.
• 5 (sequence wrap): accepted edge case. A checked atomic increment now refuses exhaustion before forwarding; a near-u64::MAX regression test proves the counter cannot wrap or reuse a sequence. Practical rate limits make this unreachable in a day, but the invariant is now exact.
• 6 (cached time): accepted narrow correction. The legacy lower-bound clock cache is inappropriate for an exact v2 admission cutoff. V2 now obtains fresh NSM timestamps; legacy drand behavior retains its original cache semantics.
• 7 (calibration): implemented measured parameters, not a cryptographic timing theorem. Graviton5 50,000-hash solo and seven-worker samples selected 43,768,124 iterations/segment, projecting ~7 solo days and ~25.14h generation. The code's measurement commits to that parameter; the client must independently pin the corresponding reviewed PCR. Hardware speed uncertainty is explicit.
• 8 (missing final solver check / quantum SHA256 attack): rejected. The review quotes the final commitment check it claims is absent. Each segment is also authenticated. A hypothetical break of the assumed cryptography is not evidence of an implementation defect.

Independent lifecycle audit

An additional source review found that generation failure or a prolonged next puzzle could leave the expired key referenced by state.active. A separate expiry watchdog now erases that state reference using a monotonic deadline even when generation or NSM access fails; bounded in-flight leases may finish sealing. The separate trusted publication deadline prevents that erasure from causing future puzzles to be published early. Regression and full lifecycle tests cover these cases. Crash-safe solver key/manifest output publication uses staged fsynced files and no-replace hardlinks to avoid permanent partial-file conflicts.

Publication lifetime starts before the first possible public puzzle write and cannot be extended by a delayed host acknowledgment. A delayed-ACK integration test proves an already expired candidate cannot become a fresh serving epoch. Public attestation saturation no longer blocks internal epoch evidence. The latest local lifecycle suite passes four tests, including these regressions, disconnect persistence, offline recovery and the full 10 MiB response bound.

Frozen release core review (Qwen3-Coder-Next via Pi)

The post-fix review of commit 474083ea74d0df069275da613e62a985d6960056 covered epoch lifecycle, response capture, archived identity verification and puzzle wrapping. It reported no concrete exploitable defect in that supplied scope: full final answer, 18,932 input and 1,379 output tokens, reported model cost $0.00337504.

That conclusion is not a security proof. Some supporting prose is inaccurate: archived decryption intentionally works after expiry and does not require an active epoch; the record sequence is an authenticated identifier, while the XChaCha nonce is independently random. The review's initial publication-order observation contradicts its own correctly listed steps. We rely on source checks and regression tests, not those unsupported explanations. No additional source change was warranted by this review.