Consent-Gated Federated Onion Routing: Linkability and Anonymity-Set Effects of an In-Band Accept/Reject Relay Model

Draft — SS4 lead paper (G4 + RQ1 + RQ2). Results/Discussion filled from the frozen §6 pass.

Blinding status (prereg §2, binding). Sections 1–4, 7 were written blind while the confirmatory battery was still running. Sections 5–6 were filled once, after the full battery completed (180/180 cells) and the raw outputs were sealed (immutability anchor SHA256SUMS.txt), from the single frozen §6 inferential pass (docs/stage-06-analysis.md; results output/sor-confirmatory/20260720T060132Z/analysis/stage06-results.json). No number was inspected before that seal. The frozen prereg (sor-consent-prereg.md, SHA-256 f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b) is authoritative and unedited.

RQ2 posterior (ratified). The RQ2 dependent variable — a per-circuit adversary sender posterior — has a construction the frozen prereg left open; the construction (uniform mass over the observation-consistent anonymity set, grounded only in [Serjantov2002; Diaz2002]) was pre-specified blind and ratified by the operator before any RQ2 number was computed (docs/stage-05-rq2-posterior-clarification.md, RATIFIED). It is recomputable offline from the sealed per-circuit seeds.

Headline (honest null/negative). Neither hoped-for effect is confirmed. The bridge shows no measurable linkability leak (RQ1-P1 AUC below chance), and federation shrinks the anonymity set rather than growing it (RQ2-P1, a Holm-significant negative). We report this plainly — nulls and negatives are results.

Abstract

Onion-routing systems typically admit any relay that meets a directory's technical criteria; they do not model relay consent — a host's in-band, per-circuit choice to carry a given flow. We build and measure a consent-gated, federated, nested-SSH relay data plane in which every hop must explicitly accept or reject each circuit through a signed in-band handshake (Ed25519-authenticated, X25519 per-hop credentials), and in which relays are organized into houses that federate either through a shared bridge or through a directory. Treating this as a measurement instrument for a trust model's exposure (not a service that provides anonymity), we ask two confirmatory questions on a single-laptop isolated-docker grid (two non-forwarding phones pinned): (RQ1) does a shared bridge introduce a measurable flow-linkability leak between a circuit's entry and exit segments, and does cover padding remove it; (RQ2) does federating relays across houses grow or shrink the anonymity set an adversary faces, and is any effect explained by bridge-concentration funnelling. All detectors are frozen and calibrated on known-linked/known-unlinked and equiprobable-sender fixtures before any confirmatory cell is run; all inference is bootstrap-based with BCa 95% CIs, Holm–Bonferroni-corrected across the confirmatory family. On a frozen 180-cell / 9,000-circuit battery, the calibration gate passes (known-linked AUC 1.00, known-unlinked 0.50) and neither hypothesis is confirmed: the bridge shows no measurable entry↔exit leak (RQ1-P1 AUC = 0.466, 95% CI [0.452, 0.480], below chance), so padding has nothing to suppress (RQ1-P2 ΔAUC = +0.011, CI [−0.002, +0.023], Holm-adjusted p = 0.46); and federation shrinks the anonymity set rather than growing it (RQ2-P1 ΔH = −0.96 bits, CI [−1.06, −0.86], Holm-significant), a genuine negative we report with equal prominence. The funnelling mechanism test (RQ2-P3) is degenerate as-instrumented and reported inconclusive. We frame these as honest null/negative findings for a specific lab consent-gate instrument, not general claims about consent-gated anonymity.

1. Introduction

Anonymous-communication systems from onion routing [Reed1997; Dingledine2004] to its SSH-based descendant SOR [Egners2012] share a membership model that is essentially permissionless at the relay: a node participates if it meets directory or protocol criteria, and the routing layer does not represent whether a host consents to carry a particular circuit. Yet in social-trust and friend-to-friend designs — Freenet [Clarke2000], membership-concealing overlays [Vasserman2009], and social-graph routers such as Pisces [Mittal2012] and X-Vine [Mittal2012b] — who is willing to relay for whom is a first-class property. No existing system, to our knowledge, makes per-circuit relay consent an in-band, cryptographically-authenticated protocol step and then measures the privacy consequences of that gate. That gap — an accept/reject relay model whose linkability and anonymity-set behaviour are empirically characterised — is the novelty this work targets (G4).

We do not propose consent-gating as a deployed anonymity service. We build it as a defensive-measurement instrument: a controlled data plane whose knobs (bridge on/off, cover padding, federation topology) let us measure how a consent gate reshapes an adversary's view. Two consequences of the gate are non-obvious and testable:

1. A shared bridge is a linkability hazard (RQ1). When federated houses route through one shared bridge node, that node observes both the entry and exit segments of circuits crossing it. Modern flow-correlation attacks link such segments at high accuracy from timing/volume alone [NasrBH18; OhYMH22; RahmanSMGW20]. We ask whether our bridge exhibits a measurable entry↔exit correlation leak, and whether cover padding closes it.

2. Consent-gating can funnel, not just spread (RQ2). Federation intuitively enlarges the candidate-sender set and thus anonymity [Serjantov2002; Diaz2002]. But a consent gate means only willing relays carry traffic; if willingness concentrates on a few bridges, circuits funnel through them and the effective anonymity set may shrink. We therefore treat the sign of the federation effect as unknown a priori and report a shrink as prominently as a growth.

Contributions. (i) The design and instrument-grade implementation of a consent-gated, federated, nested-SSH relay data plane with signed in-band accept/reject and per-hop X25519 credentials (§3, §4). (ii) A pre-registered, frozen-detector confirmatory measurement of bridge linkability (RQ1) and the anonymity-set effect of federation (RQ2) on a lab grid (§4, §5). (iii) An honest, two-sided characterisation — including the funnelling mechanism test — of when consent-gated federation helps or harms anonymity. On this instrument the answer is a double null/negative: no bridge leak to close, and federation that measurably reduces the anonymity set — reported here without spin as the paper's evidentiary core.

Scope. Claims are deliberately restricted to the tested lab topology and scale (a single laptop's isolated-docker containers; two phones pinned but non-forwarding; few houses); this is not an internet-scale or global-passive-adversary result (§7). The paired churn-resilience question (RQ3) and a QUIC/ssh3 transport arm [Michel2023] are pre-registered but held for a companion paper; this lead paper covers G4 + RQ1 + RQ2 only.

2. Related work

Onion routing and SSH-based relays. Mixes and onion routing originate with Chaum [Chaum1981] and Reed–Syverson–Goldschlag [Reed1997], with Tor [Dingledine2004] as the dominant deployment. SOR [Egners2012] is the direct prior art: it layers onion routing over stock SSH tunnels, which is exactly our transport substrate. Nesting SSH inside SSH raises the well-known TCP-over-TCP throughput/latency pathology [Honda2005], motivating our latency-aware measurement and a (exploratory) QUIC-based ssh3 transport [Michel2023]; UDP-based latency work on onion services [AlAzad2023] is complementary. None of these model per-circuit relay consent, which is the axis we add and measure.

Flow correlation / linkability (RQ1). That an adversary seeing two segments of a flow can link them is established: low-cost traffic analysis [MurdochD05], realistic-adversary correlation on Tor [JohnsonWJSS13], and deep-learning correlators DeepCorr [NasrBH18] and DeepCoFFEA [OhYMH22] achieve high linking accuracy; packet-timing (Tik-Tok [RahmanSMGW20]) and deep fingerprinting [SirinamIJW18] show timing/volume suffice. We do not advance correlator state-of-the-art; we adopt a frozen, fixture-calibrated correlator (calibration gate §5) and use its AUC purely as an instrument reading of whether our bridge leaks — the contribution is the consent-gate/bridge measurement, not the attack.

Anonymity metrics and Sybil/directory concerns (RQ2). We quantify anonymity with the information-theoretic set metrics of Serjantov–Danezis [Serjantov2002] (entropy of the adversary posterior; effective set size S = 2^H) and Díaz et al. [Diaz2002] (normalized degree d = H/log₂N). Federation across mutually-distrusting houses evokes decentralised-directory and Sybil questions [Douceur2002; Winter2016] and statistical-disclosure exposure over repeated circuits [Danezis2003]. Our matched-N design isolates the topology effect (federated vs. single-house at equal total node count) rather than a node-count artifact.

Social-trust / consent-adjacent designs (G4 neighbours). The closest neighbours treat relaying willingness or social linkage as structural: Freenet's friend-to-friend mode [Clarke2000], membership-concealing overlays [Vasserman2009], Drac's social low-volume comms [Danezis2010], and social-graph routers Pisces [Mittal2012] / X-Vine [Mittal2012b] / STor [Zhou2011]. These encode trust in the graph; none makes consent an in-band, per-circuit, signed accept/reject protocol step whose linkability and anonymity-set consequences are then measured — the specific gap G4 fills.

3. System design (the instrument)

The instrument is a nested-SSH relay data plane built into an existing zero-knowledge chat relay (hack-house), entirely within an isolated worktree. It has seven components (roadmap R1–R7); the subset load-bearing for this lead paper (RQ1 + RQ2, static selector, no model) is fully pinned by the freeze. Key mechanisms:

• Consent handshake (R5). Each hop receives a signed in-band consent request and must accept or reject before it will carry the circuit. Requests are Ed25519-signed by the originating persona and verified before acceptance; an unsigned or forged request is rejected. Per-hop credentials are X25519-sealed to the host's public key, so a hop credential decrypts only with that host's private key (no shared-symmetric secret).
• Nested-SSH circuits (R4). A circuit is a chain of SSH tunnels across grid hops; the entry and exit segments are the observable units for RQ1. Every hop's traffic is captured to an immutable per-hop pcap, written once and checksummed.
• Federation / bridge (R6). Relays are grouped into houses. Houses federate via a shared bridge node or via a directory; a circuit's federation path is chosen under split-knowledge topology constraints. The bridge is the shared observation point RQ1 probes and the concentration point RQ2's funnelling test probes.
• Determinism & provenance (R1–R3). All stochastic behaviour derives from a single --sor-seed; the seed, git SHA, and node-role→device mapping are echoed into an immutable manifest.json, and every relay event is appended to a SHA-256-sealed events.jsonl.
• Containment (binding). Every forwarder runs in an isolated engine only (assert engine != local or the run refuses). All traffic is self-generated to our own fixtures, lab-only. No external target, no live-network relay.

4. Methods (pre-registered; frozen)

This study is a confirmatory factorial controlled comparison; the design, variables, seeds, detectors, and analysis were frozen and hashed on 2026-07-19 before any confirmatory cell ran. It was designed, pre-registered, and executed under the Interpretable Context Methodology (ICM) [VanClief2026], a staged-pipeline framework in which each phase — literature, hypothesis, design/pre-registration, build, execution, analysis, and write-up — is a numbered stage whose frozen output/ is the sole input to the next. ICM is the structural mechanism behind the freeze-before-data discipline used throughout this section: the pre-registration was frozen and SHA-256-sealed in the design stage before the build and execution stages could consume it, so the provenance chain (§4.4) is auditable by construction rather than by convention.

4.1 Design matrix

Cells are organised per RQ with the other factors held at their declared control:

• RQ1 (linkability): bridge ∈ {off, on, on+padding} — 3 levels; topology held at single-house, selector static. (bridge-off+padding is declared N/A — padding is defined only for bridge-on.)
• RQ2 (anonymity set): topology ∈ {1-house-N, bridge-federated, directory-federated} at matched total node count N — 3 levels; bridge held off, selector static.

Full crossing is not run. Run order is randomised within each cell and the control arm is interleaved before and after treatments so grid calibration drift is caught. All stochastic elements are seed-controlled.

4.2 Dependent variables

• RQ1 — correlation AUC. Area under the ROC of the frozen flow-correlation detector scoring (entry-segment, exit-segment) pairs as same/different circuit, measured from the real per-hop pcaps. Unit of analysis: the (entry, exit) pair; 95% CI by bootstrap over circuit pairs.
• RQ2 — anonymity-set entropy H. Shannon entropy of the adversary's posterior over candidate senders per circuit; effective set size S = 2^H [Serjantov2002], normalized d = H/log₂N [Diaz2002]; Miller–Madow finite-sample bias correction; 95% CI by bootstrap over circuits. Unit of analysis: the circuit. ΔH = H(federated) − H(single-house, matched N).

  Construction (ratified). The prereg pins this DV as a per-circuit posterior but does not give the posterior construction rule. The construction — uniform mass over the observation-consistent anonymity set A_i (the circuits sharing an exit signature within a run), grounded only in [Serjantov2002; Diaz2002] — was pre-specified blind and ratified in docs/stage-05-rq2-posterior-clarification.md. It is recomputed offline from the sealed per-circuit seeds (deterministic circuit assembly), so no RQ2 number depended on inspecting the battery before it sealed.

4.3 Sampling & power

R = 30 independent seeded runs per cell; each run builds C = 50 circuits (≥ 1500 scored pairs per cell for RQ1). The target is precision, not a formal power analysis: ≥ 1500 pairs yields an expected bootstrap 95% CI half-width on AUC ≤ 0.03, enough to resolve the RQ1 floor away from 0.5. One base seed S0 = 20260719; per-cell seed = SHA256(S0 ‖ cell_id ‖ run_index) truncated to u64, echoed into every manifest. Stopping rule: all cells × R runs run to completion — no optional stopping, no interim looks; an uninformative cell is reported inconclusive, never extended to chase significance.

Apparatus (disclosed). All relay hops ran as isolated Docker containers on a single engine host (the laptop; grid/device-map.json, isolated_engine_host_count = 1, Docker 27.5.1). The two phones were pinned consenting-node labels, not forwarders (probed reachable once at grid-pin; carried no measured traffic — the device map records both phones with can_host_engine = false / isolated_engine_available = false, i.e. structurally unable to run an isolated forwarder). Node distinctness is thus container-level (≥ 3 distinct containers per circuit), and matched-N is pinned from the containerised node count per manifest; cross-machine effects are out of scope (§7).

4.4 Frozen detectors and the instrument-validation gate

Detectors (correlator, entropy estimator, classifier) are written and calibrated only on the instrument-validation fixtures — known-linked/known-unlinked control pairs and equiprobable-sender synthetic sets — before any confirmatory cell is run; no per-cell tuning is permitted. The battery ran only after all six boolean gate items passed green: (1) 3-hop end-to-end delivery with per-hop pcap + checksum; (2) seeded reproducibility (same seed → identical circuit-build sequence); (3) correlator calibration (known-linked AUC ≈ 1, known-unlinked ≈ 0.5); (4) entropy calibration (H = log₂N for N equiprobable senders); (5) isolation (assert engine != local or refuse); (6) provenance integrity (replayed fixture → schema-valid events.jsonl whose SHA-256 matches the manifest; append-only).

4.5 Analysis plan

Effect size + 95% CI for every comparison; p-values never reported alone. All inference is bootstrap/permutation-based (10,000 resamples, BCa intervals; 3-seed spot-check to MC error).

• RQ1-P1 (leak). Bridge-on correlation AUC, bootstrap 95% CI. Confirmation gate = CI excludes 0.5 (leak present); null if CI includes 0.5. Materiality is a separate label: CI lower bound ≥ 0.60 ⇒ "material leak"; between 0.5 and 0.60 ⇒ "weak-but-real leak."
• RQ1-P2 (padding efficacy). ΔAUC = AUC(bridge-on, no-pad) − AUC(bridge-on, +pad); paired bootstrap 95% CI. Padding effective iff ΔAUC CI > 0.
• RQ2-P1 (federation effect, two-sided). ΔH bootstrap 95% CI; the sign is not presumed. grow if CI > 0; honest shrink (reported with equal prominence) if CI < 0; inconclusive if it spans 0.
• RQ2-P3 (funnelling mechanism). Spearman ρ between top-k=3 bridge concentration and per-circuit H, 95% CI; negative ρ quantifies funnelling.
• Multiple comparisons. Holm–Bonferroni over the frozen family of 7 confirmatory tests {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}; the 4 lead-paper tests are reported at Holm-adjusted multipliers 7, 6, 5, 4 (conservative embedding — see docs/stage-05-holm-clarification.md, ratified). EXPLORATORY results (QUIC transport; any post-hoc contrast) are labelled and excluded from the confirmatory column.
• Data exclusion (pre-data). A run is quarantined (logged, never silently dropped) only on a data-integrity failure (SHA mismatch, pcap checksum failure, in-place edit, or non-reproducing seed). No performance-based exclusions.
• Bootstrap implementation (method-faithful, not method-substituted). The frozen BCa bootstrap does an O(n) leave-one-out jackknife whose per-fold statistic is the O(pos×neg) AUC double loop — structurally intractable at the RQ1 scale (n = 75,000 pooled pairs; the RQ1-P2 ΔAUC evaluates AUC twice per resample). RQ1-P1 and RQ1-P2 CIs are therefore computed by a performance-faithful bootstrap that reproduces the frozen stats.bootstrap_ci bit-for-bit (identical random.Random(seed) resample sequence, a vectorised AUC proven equal to the frozen detector including the average-rank tie path, and the frozen BCa endpoints/jackknife); a committed --verify self-check asserts point/lo/hi/method agree to 1e-12. RQ2-P1 and RQ2-P3 remain on the unmodified frozen paths. No point estimate, CI gate, or decision is changed.

5. Results

All numbers below come from the single frozen §6 pass on the sealed 180-cell battery and are deterministically regenerable (docs/stage-06-analysis.md; seed S0 = 20260719; 10,000 BCa resamples; α = 0.05). Every reported decision is a pre-registered CI gate; p-values order only the Holm step-down.

5.1 Instrument-validation gate report

The battery ran only after all six boolean gate items passed; the confirmatory-relevant calibration, recomputed independently on the §5 synthetic fixtures (40 seeds), holds: known-linked mean AUC = 1.0000 (criterion ≥ 0.95) and known-unlinked mean AUC = 0.5036 (criterion 0.40–0.60). Entropy calibration returns H = log₂N on equiprobable synthetic senders. Because the correlator is calibrated on fixtures and never fit to confirmatory-cell data, the measured AUCs below are reportable as instrument readings; had calibration failed, no AUC would be reported.

5.2 RQ1 — bridge linkability

RQ1-P1 (leak). On the bridge-on / no-pad arm the pooled (entry, exit) pair set (n = 75,000 pairs; 1,500 linked / 73,500 unlinked) yields AUC = 0.4660, BCa 95% CI [0.4523, 0.4798]. The CI excludes 0.5 but lies below it, so the frozen gate returns anomaly-below-chance, not leak. The correlator does not link entry↔exit segments better than chance on the bridge-on traffic; it sits marginally below chance — an unexplained artifact of the pooled correlator on this as-instrumented traffic (this is the no-pad arm, so no cover stream is involved), not a linkability finding — so we report no measurable leak. The two-sided rejection at AUC = 0.5 is in the wrong direction and is not evidence of linkability.

RQ1-P2 (padding efficacy). Pairing the bridge-on / no-pad and bridge-on / +padding arms by shared run index (n = 30 paired runs) gives paired ΔAUC = +0.0113, BCa 95% CI [−0.0025, +0.0234] (per-run ΔAUCᵢ range ≈ [−0.080, +0.081], straddling zero). The CI spans 0 → frozen gate padding-ineffective (raw p = 0.091). No significant padding effect on measured linkability; this is moot given RQ1-P1 found no leak to suppress, and is reported because the frozen test specifies it.

5.3 RQ2 — anonymity-set effect of federation

RQ2-P1 (federation effect, two-sided). Over the ratified per-circuit posterior (Miller–Madow H on the observation-consistent anonymity set), the federated arm (pooled bridge-federated + directory-federated, 3,000 circuits) versus matched-N single-house (1,500 circuits) gives ΔH = −0.9587 bits, BCa 95% CI [−1.0559, −0.8641]. The CI is strictly below 0 → frozen gate shrink. Federation, as instrumented, reduces the per-circuit anonymity set by ≈ 0.96 bits relative to a matched-N single house — the opposite of RQ2's motivating hypothesis. Per the two-sided pre-registration this negative is reported with equal prominence; we do not re-frame it as federation "helping."

RQ2-P3 (funnelling mechanism). Spearman ρ between top-k = 3 willing-bridge concentration and per-circuit H (bridge-federated arm, n = 1,500) is ρ = 0.0000, CI [0.0000, 0.0000] (percentile fallback) → inconclusive. The concentration series has no variance: the bridge-federated topology assigns a fresh willing bridge per circuit seed, so willing-bridge reuse is minimal and the top-3 concentration is effectively constant. Spearman is undefined on a zero-variance covariate. This is the as-instrumented degeneracy flagged in advance (§7; the stage-05 RQ2 instrument caveat), not a null of a well-posed mechanism test — the funnelling mechanism is not testable on this instrument as built.

5.4 Holm-corrected confirmatory summary

Holm–Bonferroni over the frozen family of 7 (reporting the 4 lead-paper tests at conservative multipliers 7, 6, 5, 4, ordered by ascending raw p):

* RQ1-P1 rejects H0: AUC = 0.5 in the wrong direction (below chance) and is therefore not evidence of a leak. Two tests survive Holm at α = 0.05: RQ1-P1 (anomaly-below-chance) and RQ2-P1 (shrink — a negative effect). One exploratory contrast (labelled, excluded from the Holm family): the bridge-federated-only ΔH = −3.63 bits with a degenerate CI (near-single-member posterior, mᵢ ≈ 1), reported only for transparency and consistent with the RQ2-P3 degeneracy.

6. Discussion

A double null/negative, reported without spin. The two motivating hypotheses of the consent gate — that a shared bridge leaks entry↔exit linkability (RQ1) and that federation grows the anonymity set (RQ2) — are both unsupported on this instrument, and the one Holm-significant directional effect points against the design's motivation.

RQ1 — no bridge leak to close. The frozen, fixture-calibrated correlator (linked AUC 1.00, unlinked 0.50) reads the bridge-on traffic at AUC 0.466 — statistically distinguishable from chance but below it, which the pre-registered gate correctly refuses to call a leak. We do not have a substantiated mechanism for the slight below-chance offset; it is a small artifact of the pooled correlator on this as-instrumented traffic (and it is not a padding effect — this is the no-pad arm, which carries no cover stream). Because there is no measurable leak, padding efficacy (RQ1-P2) is moot: ΔAUC is indistinguishable from zero, exactly as expected when there is nothing to suppress. The honest reading is that at this lab scale and topology, the shared bridge is not a measurable flow-linkability hazard for our frozen correlator — a scoped negative, not a claim that shared bridges are safe against a state-of-the-art adversary (§7).

RQ2 — federation shrinks the anonymity set. The evidentiary core is the Holm-significant ΔH = −0.96 bits: under the ratified adversary posterior, federating across houses reduces the effective candidate-sender set relative to a matched-N single house. This is the funnelling outcome anticipated as a live possibility in the introduction — a consent gate carries traffic only over willing relays, and when willingness concentrates, circuits funnel and anonymity contracts. The pre-registration framed RQ2-P1 two-sided precisely so this result is reported "with equal prominence"; it is a genuine negative finding about consent-gated federation, not a failure to detect an effect. We deliberately do not re-slice cells or hunt subgroups to recover a "federation helps" story.

Why the funnelling mechanism test is inconclusive. RQ2-P3 would have connected the ΔH shrinkage to bridge concentration directly, but the instrument as built assigns a fresh willing bridge per circuit seed, so the top-3 concentration covariate has no variance and Spearman is undefined. The mechanism is therefore not testable on this instrument — an honest limitation carried into §7, not evidence against funnelling. The exploratory bridge-federated-only ΔH = −3.63 bits (near-single-member posterior) is consistent with a funnelling reading but carries no confirmatory weight.

Takeaway. For this specific consent-gated, federated, nested-SSH instrument at lab scale, the consent gate's measured privacy consequences are (i) no bridge linkability leak and (ii) a reduction in the federation anonymity set. Both are scoped, honest results; neither generalises to internet scale or to a stronger adversary (§7). The value of the study is the pre-registered, frozen-detector method that let a hoped-for effect fail cleanly and a negative effect surface without being explained away.

7. Limitations & threats to validity

• Scale / adversary model (External). The grid is a single laptop (isolated-docker) with two non-forwarding phones pinned, and few houses; this is not internet-scale and not a global passive adversary. Claims are scoped to the tested topology/scale; entropy CIs are wide at small node counts (accepted, node counts reported).
• Node distribution (External, disclosed). All relay hops executed as isolated Docker containers on a single engine host (the laptop; isolated_engine_host_count = 1, recorded in grid/device-map.json). The two phones were pinned consenting-node labels, not forwarders — they cannot host an isolated engine (grid/device-map.json records both phones with can_host_engine = false / isolated_engine_available = false), were verified reachable only by a single grid-pin probe, and carried no measured traffic. Node distinctness for RQ1/RQ2 is therefore container-level (≥ 3 distinct containers per circuit), not physical-machine-level; matched-N is pinned from the containerised node count per manifest. This satisfies the containment law (every forwarder runs in an isolated engine, engine ≠ local) but means cross-machine timing effects are out of scope; physical multi-host distribution is named future work.
• Construct. Self-generated fixture traffic is not real user traffic (inherent to lab measurement; fixtures versioned/checksummed). A single correlator's AUC stands in for "linkability" and plug-in H for "anonymity" — mitigated by fixture calibration (§4.4) and by reporting S = 2^H and normalized d; a second entropy estimator (NSB) is reported EXPLORATORY as a sensitivity check.
• Internal. Thermal/background load and device heterogeneity are mitigated by randomised order, interleaved controls, per-session idle baselines, and a pinned node-role→device mapping. Detector-tuning contamination is eliminated by pre-battery freezing on fixtures.
• RQ2 construction dependency. The RQ2 result depends on the ratified posterior construction (§4.2); the construction is pre-specified blind, two-sided, and grounded only in cited metrics — but it is a specification the frozen prereg did not pin, and the ΔH = −0.96 bits finding should be read as conditional on it.
• Funnelling mechanism not testable as-instrumented (RQ2-P3). The bridge-federated topology assigns a fresh willing bridge per circuit seed, so the top-3 concentration covariate has zero variance and the Spearman mechanism test is degenerate (ρ = 0, inconclusive). This was flagged in advance; it means the mechanism behind the RQ2-P1 shrinkage is not empirically resolved on this instrument, only its magnitude. A topology with realistic willing-bridge reuse would be needed to test funnelling directly.
• Dual-use (ethics). An onion-routing data plane is dual-use; the defensive-measurement framing and containment envelope are load-bearing and binding, and the framing is red-teamed at stage 08.

8. Deviations from pre-registration

Tracked only in stage-05 sor-consent-deviations.md (none edit the frozen prereg). Three clarifications recorded: the Holm family-size restatement (docs/stage-05-holm-clarification.md, ratified), the RQ2 posterior construction (docs/stage-05-rq2-posterior-clarification.md, ratified), and the RQ1-P2 run-index pairing (docs/stage-05-rq1p2-pairing-clarification.md, freeze-derived / ratified). One implementation note carried in §4.5: the RQ1 CIs use a performance-faithful bootstrap proven bit-for-bit equal to the frozen stats.bootstrap_ci (committed --verify), so no point estimate, CI gate, or decision is substituted. The frozen prereg SHA is unchanged (f22331a72e…).

References

• [Chaum1981] Chaum, D. L. (1981). Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms. CACM 24(2), 84–90. https://doi.org/10.1145/358549.358563
• [Reed1997] Reed, M. G., Syverson, P. F., & Goldschlag, D. M. (1997). Anonymous Connections and Onion Routing. IEEE S&P 1997, 44–54. https://doi.org/10.1109/secpri.1997.601314
• [Dingledine2004] Dingledine, R., Mathewson, N., & Syverson, P. (2004). Tor: The Second-Generation Onion Router. USENIX Security 2004.
• [Egners2012] Egners, A., Gatzen, D., Panchenko, A., & Meyer, U. (2012). Introducing SOR: SSH-based Onion Routing. IEEE WAINA 2012, 280–286. https://doi.org/10.1109/WAINA.2012.89
• [Honda2005] Honda, O., et al. (2005). Understanding TCP over TCP. SPIE 6011. https://doi.org/10.1117/12.630496
• [Michel2023] Michel, F., & Bonaventure, O. (2023). Towards SSH3. arXiv:2312.08396.
• [AlAzad2023] Al Azad, M. W., et al. (2023). DarkHorse. IEEE LCN 2023. arXiv:2307.02429.
• [MurdochD05] Murdoch, S. J., & Danezis, G. (2005). Low-Cost Traffic Analysis of Tor. IEEE S&P 2005, 183–195. https://doi.org/10.1109/SP.2005.12
• [JohnsonWJSS13] Johnson, A., et al. (2013). Users Get Routed. ACM CCS 2013, 337–348. https://doi.org/10.1145/2508859.2516651
• [NasrBH18] Nasr, M., Bahramali, A., & Houmansadr, A. (2018). DeepCorr. ACM CCS 2018, 1962–1976. https://doi.org/10.1145/3243734.3243824
• [OhYMH22] Oh, S. E., et al. (2022). DeepCoFFEA. IEEE S&P 2022, 1915–1932. https://doi.org/10.1109/SP46214.2022.9833801
• [RahmanSMGW20] Rahman, M. S., et al. (2020). Tik-Tok. PoPETs 2020(3). https://doi.org/10.2478/popets-2020-0043
• [SirinamIJW18] Sirinam, P., et al. (2018). Deep Fingerprinting. ACM CCS 2018, 1928–1943. https://doi.org/10.1145/3243734.3243768
• [Serjantov2002] Serjantov, A., & Danezis, G. (2002). Towards an Information Theoretic Metric for Anonymity. PET 2002, LNCS 2482, 41–53. https://doi.org/10.1007/3-540-36467-6_4
• [Diaz2002] Díaz, C., et al. (2002). Towards Measuring Anonymity. PET 2002, LNCS 2482, 54–68. https://doi.org/10.1007/3-540-36467-6_5
• [Douceur2002] Douceur, J. R. (2002). The Sybil Attack. IPTPS 2002, LNCS 2429, 251–260. https://doi.org/10.1007/3-540-45748-8_24
• [Danezis2003] Danezis, G. (2003). Statistical Disclosure Attacks. IFIP SEC 2003.
• [Winter2016] Winter, P., et al. (2016). Identifying and Characterizing Sybils in the Tor Network. USENIX Security 2016, 1169–1185.
• [Clarke2000] Clarke, I., et al. (2000/2001). Freenet. Designing PETs, LNCS 2009. https://doi.org/10.1007/3-540-44702-4_4
• [Vasserman2009] Vasserman, E. Y., et al. (2009). Membership-Concealing Overlay Networks. ACM CCS 2009, 390–399. https://doi.org/10.1145/1653662.1653709
• [Danezis2010] Danezis, G., et al. (2010). Drac. PETS 2010, LNCS 6205, 202–219. https://doi.org/10.1007/978-3-642-14527-8_12
• [Mittal2012] Mittal, P., Wright, M., & Borisov, N. (2012). Pisces. NDSS 2013. arXiv:1208.6326.
• [Mittal2012b] Mittal, P., Caesar, M., & Borisov, N. (2012). X-Vine. NDSS 2012. arXiv:1109.0971.
• [Zhou2011] Zhou, P., et al. (2011/2013). STor. arXiv:1110.5794.
• [VanClief2026] Van Clief, J., & McDermott, D. (2026). Interpretable Context Methodology: Folder Structure as Agentic Architecture. arXiv:2603.16021. (Methodology framework under which this study was staged, pre-registered, and executed.)

(Full bibliography: docs/sor-consent-bibliography.md (vendored in-repo). Integrity flags carried forward: [Stutzbach2006] secondary-sourced; [Constantinides2026] recent preprint — neither is load-bearing in this lead paper.)

Companion Methods (BLIND scaffold): The Unique-Bridge / Mix Mechanism (RQ2-P3) and Churn-Resilient Agent Selection (RQ3)

Draft — companion methods. Both tracks have cleared their human gates (RQ2-P3 freeze; RQ3 operator-GO); Results/Discussion are UN-BLINDED and filled from the sealed records only.

Paper-structure note (deliberately left OPEN). Whether this material ships as a second standalone paper, as extension sections folded into the lead paper (docs/stage-07-paper-draft.md), or as a short mechanism note is an operator editorial decision and is not pre-committed here. The two methods tracks below are therefore written as self-contained sections that can be lifted into either structure.

Blinding & gating status (binding). - RQ2-P3 mechanism study — FROZEN + SEALED; its Results/Discussion are now UN-BLINDED below. The prereg (docs/rq2p3-mechanism-prereg.md, own slug sor-consent-rq2p3) was frozen 2026-07-21 (§10 signed; full-file SHA-256 8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b in the sidecar docs/rq2p3-mechanism-prereg.sha256). The confirmatory battery then ran offline + deterministic and its record is sealed (output/sor-rq2p3-confirmatory/…, results SHA-256 5fdcb379d8a2…). §5/§6 for RQ2-P3 are filled from that sealed record only, the same post-seal discipline the lead paper used. - RQ3 companion — RUN + UN-BLINDED. Hypotheses, gates, and analysis are frozen in the lead prereg (sor-consent-prereg.md, SHA-256 f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b, §3/§4/§6); the two open [APPROVAL] execution params were pinned blind in docs/rq3-companion-run-brief.md. The confirmatory battery ran operator-GO'd on the live isolated docker grid (3 arms × R=30 × C=50 = 4,500 real circuits, live-docker-e2e) and its record is sealed (output/sor-rq3-confirmatory/…, battery SHA-256 5b61e461…, analysis SHA-256 e09c66ef…). §5/§6 for RQ3 are filled from that sealed record only. - All Results / Discussion below are now UN-BLINDED, filled from the sealed records only. Both tracks have cleared their human gates (RQ2-P3 freeze; RQ3 operator-GO); the authoritative Holm-7 over the frozen size-7 family is computed. The frozen lead prereg is authoritative and unedited; the lead RQ1/RQ2-P1 findings are not re-litigated.

Abstract (both tracks UN-BLINDED — confirmatory findings folded in from the sealed records)

The lead study measured a consent-gated, federated, nested-SSH relay instrument and reported two honest non-confirmations: no measurable entry↔exit linkability leak (RQ1) and a Holm-significant shrink of the per-circuit anonymity set under federation (RQ2-P1). This companion pursues the two questions the lead paper could not close. First (RQ2-P3′, a mechanism study): the lead "shrink" may be an instrument artifact — the bridge-federated topology assigns a fresh willing bridge per circuit seed, so every adversary-observable exit signature is unique, every anonymity set collapses to size 1, and entropy is driven to ≈0 by construction rather than by funnelling. We re-instrument the willing-bridge layer as a finite shared pool with skewed willingness and treat bridge concentration as a manipulated independent variable (a 3×3 dose-response over pool size and skew), asking two-sided whether concentration reduces (funnel) or raises (mix) the anonymity set. Second (RQ3, churn resilience): we measure whether a local open-weight agent path-selector (qwen2.5:3b) retains throughput and adds tolerable latency under a pinned churn schedule, without leaving a classifiable rebuild fingerprint. Both tracks are pre-registered, detector-frozen, and calibration-gated before any confirmatory cell. (Confirmatory findings, now un-blinded: RQ2-P3 resolves MIX — shared-pool concentration raises the anonymity set, correcting the lead "shrink" as a unique-bridge artifact; RQ3 is a null on both counts — on this grid every selector heals ~all churn (no +10 pp agent margin) and the rebuild-timing fingerprint cannot be excluded at n=30. The authoritative Holm-7 leaves RQ1-P1, RQ2-P1, and RQ2-P3 surviving.)

1. Introduction (deltas beyond the lead paper)

The lead paper (G4 + RQ1 + RQ2) established the consent-gate instrument and reported its linkability and anonymity-set readings. Two threads there were raised but not resolved, and this companion is scoped to exactly those.

(a) The unique-bridge / mix mechanism. The lead RQ2-P1 result — federation shrinks the anonymity set (ΔH < 0) — was reported honestly, but the lead paper also flagged its RQ2-P3 mechanism test as degenerate as-instrumented: the bridge-federated arm assigns a fresh bridge per circuit seed, so top-3 bridge concentration is a constant c_i = 1/C with zero variance and Spearman ρ is undefined. The mechanistic reading (developed in docs/note-unique-bridge-artifact.md) is that the adversary's observable is an exit_signature = (exit_house, bridge_label); a unique bridge per circuit makes every signature unique, so the observation-consistent anonymity set is size 1 and H≈0 by injective construction, not by funnelling. If that is right, a finite shared bridge pool should make circuits share signatures, enlarge the anonymity set, and act as a mix (concentration raises H) — the opposite of the naive funnel intuition. This makes RQ2-P3′ a test of whether the lead "shrink" headline is a unique-bridge artifact that a mechanism study can qualify or correct. This mix reading connects the consent-gate bridge to the classical mix [Chaum1981] and to information-theoretic set metrics [Serjantov2002; Diaz2002] the lead paper already adopts.

(b) Churn-resilient agent selection. The lead paper held the selector at static; RQ3 asks whether an adaptive selector improves resilience when the relay pool churns. Two costs bound any such gain and are the confirmatory tension: (i) rebuilding a circuit after a dropped hop adds latency and can erode throughput, and (ii) the timing pattern of rebuilds is itself a side-channel — a rebuild-event classifier could fingerprint the selector, echoing website- and flow-fingerprinting results on onion transports [SirinamIJW18; RahmanSMGW20] and the rebuild/timing-classifier spirit of CLASI [Barton2025], and compounding statistical-disclosure exposure over repeated circuits [Danezis2003]. RQ3 therefore pairs a performance gate with an anonymity (non-fingerprint) gate: an agent selector only "helps" if it retains throughput at tolerable added latency and its rebuild pattern is not classifiable.

2. Related work (deltas)

The lead paper's Related Work (onion routing / SOR [Egners2012], flow correlation [NasrBH18; OhYMH22], anonymity metrics [Serjantov2002; Diaz2002], social-trust G4 neighbours) is inherited unchanged. The companion adds two narrow deltas, citing only already-grounded references:

• Bridge-as-mix vs. bridge-as-funnel. Concentrating flows through few willing bridges can be read either as a funnel (fewer distinct observation classes → smaller sets) or as a mix [Chaum1981] (shared observation class → larger sets). The set-size effect is quantified with the same entropy metrics the lead paper uses [Serjantov2002; Diaz2002]; the companion's contribution is a manipulated-concentration dose-response that adjudicates the sign, not a new estimator.
• Rebuild-timing as a fingerprint. Churn-driven circuit rebuilds create a timing series an adversary may classify; this is the fingerprinting/timing lineage [SirinamIJW18; RahmanSMGW20; Barton2025] applied to selector-induced rebuild events rather than page loads. The companion adopts a frozen, fixture-calibrated rebuild classifier and reads its AUC as an instrument reading, mirroring the lead paper's frozen-correlator discipline (no correlator/classifier state-of-the-art is claimed).

3. Methods A — RQ2-P3′ funnelling-mechanism study [FROZEN 2026-07-21 — prereg §10 signed]

This section describes a study whose prereg (docs/rq2p3-mechanism-prereg.md) is FROZEN. Design and parameters were operator-approved and locked; the human freeze checkpoint (§10 signed 2026-07-21, full-file SHA-256 8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b in the sidecar docs/rq2p3-mechanism-prereg.sha256) is complete. The confirmatory battery then ran offline + deterministic and its record is sealed (results SHA-256 5fdcb379d8a2…). Everything below is the pre-registered plan exactly as frozen; the §5/§6 numbers are read from that sealed record only.

Design (manipulated-IV dose-response). A new assembler topology, bridge-federated-pool, replaces the fresh-per-seed bridge with a finite willing-bridge pool of size B under a fixed Zipf willingness skew alpha: weights = zipf_weights(B, alpha) derived from the cell seed (so the willingness profile is fixed within a run), and each circuit draws idx = weighted_draw(sha256("sor-bridge-pool|{circuit_seed}"), weights) → bridge#{idx:02d}, a label reused across circuits so concentration genuinely varies. Everything downstream (hop structure, houses, exit-signature grouping, Miller–Madow entropy, BCa bootstrap) is identical to the frozen lead pipeline; the lead bridge-federated branch is untouched and bit-reproducible. The manipulation grid is B ∈ {2, 4, 8} × alpha ∈ {0 (uniform), 1.0, 2.0} = 9 concentration cells; run order randomized within cell from an ordering seed distinct from the data seeds.

Hypotheses (two-sided; direction not presumed). - H1 (within-cell association). Spearman ρ between per-circuit top-3 willing-bridge concentration c_i and per-circuit entropy H_i. Funnel iff BCa 95% CI < 0; mix iff CI

0; inconclusive iff CI spans 0. - H2 (dose-response). OLS slope β of per-run mean-H on per-run mean top-3 concentration over 9 cells × 30 runs = 270 clustered points; cell-level BCa CI; funnel iff slope CI < 0, mix iff CI > 0. - H3 (joint, direction-agnostic). Mechanism RESOLVED iff H1 and H2 agree in sign and both exclude 0 — the sign (funnel vs mix) is the finding; unresolved if either spans 0.

Dependent variables. Per-circuit H_i (Miller–Madow entropy of the uniform posterior over the observation-consistent anonymity set, inherited verbatim) and per-circuit top-3 concentration c_i (confirm_load_rq2.bridge_concentration, unchanged).

Sampling. R = 30 seeded runs/cell, C = 50 circuits/run (matched to the lead study); base seed S0 = 20260719, per-cell seed SHA256(S0 ‖ cell_id ‖ run_index); fixed stopping rule (all 9 cells × R to completion; uninformative cell → inconclusive; no optional stopping).

Analysis. Effect size + BCa 95% CI (10,000 resamples, α = 0.05) for every test; run-level cluster bootstrap (resample whole runs, not circuits) because circuits sharing a bridge have identical c_i and correlated H_i — the same pseudo-replication defect the lead paper flagged for RQ1-P1. Holm–Bonferroni over this study's own family {H1-pooled, H2-slope}; the lead family-of-7 is closed and not reopened here. Any per-cell ρ contrast or ΔH replication is labelled EXPLORATORY, never a re-run of the frozen RQ2-P1.

Instrument-validation gate (§7, re-worded pre-freeze — cite docs/stage-05-rq2p3-gate-clarification.md). The §7 items were re-worded before freeze because the original items 1–2 encoded the naive-funnel prior and were mechanically wrong under the ratified posterior (transparent deviation logged; no hypothesis changed — H1/H2/H3 stay two-sided). The re-worded gate validates the instrument, not a sign: 1. the frozen bridge-federated branch (not the pool) still shows the lead degeneracy — unique signatures → m_i = 1 → H_i ≈ 0, constant c_i = 1/C (a pool draws with replacement and cannot reproduce the injective fresh-bridge degeneracy, so the regression teeth live on the untouched branch); 2. the B = 1 boundary yields c = 1.0 (concentration tooth) and, under the ratified posterior, H at the high end (maximal mix) — the naive "low H" gloss is refuted by construction; 3. realized mean top-3 concentration is monotone (decreasing in B, increasing in alpha); 4. entropy calibration inherited (H = log₂N on equiprobable synthetic senders). A §7 scope note records that the gate must not pre-assert the H-vs-concentration sign — that sign is the two-sided confirmatory question; baking it in would be funnel-circular.

Pre-registered calibration finding (NOT a confirmatory result). The dry §7 pass — synthetic, offline, no confirmatory record read — already previews a mix: across the sweep Spearman ρ runs from ≈0 up to +0.838 (all cells ρ ≥ 0), the B = 1 boundary sits at high entropy (≈2.54 bits vs the fresh-bridge reference ≈0.0), and monotonicity + entropy calibration pass. This is surfaced openly as a pre-registered calibration preview, per the §7 scope note; it does not relax the two-sided pre-commitment, and the confirmatory sign remains withheld until after freeze. Honest disclosure the eventual write-up must carry: because the dry pass already previews the mix direction, the confirmatory battery quantifies a dose-response already visible at calibration; the two-sided pre-commitment stands and the lead RQ2-P1 headline is not re-litigated.

4. Methods B — RQ3 churn-resilient agent selector (frozen prereg)

Hypotheses, gates, DVs, and analysis are frozen in sor-consent-prereg.md (§3/§4/§6) and are restated, not redefined. The two open [APPROVAL] execution params were pinned blind to RQ3 outcomes (docs/rq3-companion-run-brief.md §2).

Design. Selector strategy {static, random, agent} at the RQ3 control cell (single-house / bridge-off) under a pinned churn schedule; static is the interleaved control, and control runs are bracketed before and after the {random, agent} treatments to catch grid drift. The cells are enumerated separately from the frozen 6-cell lead lattice so the lead battery stays bit-reproducible.

Pinned execution parameters (blind). - Agent = qwen2.5:3b via local Ollama (agent_selector.OllamaAgentPolicy, temperature 0, per-run seed, (seed, state-hash) decision cache, deterministic heuristic fallback on query failure). Local / open-weight, $0; the Claude/frontier arm (ClaudeExploratoryPolicy) stays inert / EXPLORATORY / budget-gated and is not wired. - Reproducibility caveat (accepted; must be stated in the paper). Ollama at temperature 0 is not bit-identical across machines (quantization / GPU logit drift). The agent arm is reproducible via the committed decision-log + (seed, state-hash) cache replay, not via independent model re-execution on other hardware — the same honesty class as the RQ1 timing caveat. The decision log + cache are committed as the reproducibility anchor. - Churn = kill_prob_pct = 30, steps = 20, one deterministic schedule per run seeded from the same SHA256(S0 ‖ cell ‖ run) family; low-churn calibration baseline kill_prob_pct = 5.

Dependent variables (frozen). Throughput retention (throughput under churn / no-churn baseline); added latency = median end-to-end latency(agent) − median latency(best baseline arm), in ms — a live measurement only; and rebuild-classifier AUC over the rebuild-event time series (the per-run mean inter-rebuild-gap signal), per the [Barton2025] CLASI spirit.

Confirmatory gates (frozen, family-of-7).

R = 30 runs/cell, C = 50 circuits/run, fixed stopping rule (inherited unchanged).

Analysis + multiplicity (Holm-7 supersedes note). The three RQ3 tests were always in the frozen size-7 family {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}. Once all seven p-values exist, the companion computes the exact Holm-7 step-down over the whole family; this is the authoritative final correction and supersedes the lead paper's deliberately conservative partial embedding (7/6/5/4 report-4) — both remain valid, the partial never under-corrects, and the lead paper's already-published RQ1-P1 / RQ2-P1 survive regardless (their reported raw p ≈ 0 — a lead-paper result, not a companion figure). Effect size + BCa 95% CI for every test; nulls reported honestly (a selector that does not beat baselines, or a rebuild pattern that is classifiable, is the finding). The QUIC / ssh3 transport arm stays EXPLORATORY and deferred (design decision D3), never in the Holm family.

Calibration gates (already green; NOT confirmatory results). Two boolean gates block the RQ3 confirmatory battery and have both passed on a dry, synthetic, offline pass: - Churn-bites — at the pinned kp = 30 / steps = 20 the churn genuinely bites (non-zero drops/rebuilds across every RQ3 cell), so the retention and classifier tests are not degenerate. - Rebuild-classifier calibration — churned (kp = 30) vs low-churn baseline (kp = 5) is separable on the per-run mean inter-rebuild-gap signal (calibration AUC ≈ 0.93), while baseline-vs-baseline is not (null AUC ≈ 0.52); plus an agent cache-replay reproducibility check and the inherited entropy calibration. These are calibration readings on labelled control signals, not fit to confirmatory cells; the frozen instrument (rebuild_interval_gaps, rebuild_classifier_auc) is unchanged.

5. Results (both tracks UN-BLINDED — filled from the sealed records only)

• RQ2-P3′ (H1 / H2 / H3) — RESOLVED: MIX. From the sealed confirmatory record (9 cells × R=30 × C=50, offline + deterministic, S0 = 20260719):
• H1 (within-cell association). Pooled Spearman ρ = +0.6244, BCa 95% CI [+0.5941, +0.6545] (run-level cluster bootstrap, 10,000 resamples). CI excludes 0 on the positive side → mix.
• H2 (dose-response). OLS slope of per-run mean-H on per-run mean concentration β = +0.7052, BCa 95% CI [+0.6195, +0.7903] over n = 270 run-level points. CI positive → mix.
• H3 (joint). H1 and H2 agree in sign (both +) and both exclude 0 → mechanism RESOLVED = MIX.
• Holm (own family {H1-pooled, H2-slope}, size 2). Both tests reject at α = 0.05 after Holm correction. (p carried only for Holm ordering; the effect + CI above are the reported quantities — never a bare p.)
• Across the sweep, as pool size B rises concentration falls and entropy H falls together (e.g. B=2/α=0: conc ≈ 1.00, H ≈ 2.54; B=8/α=0: conc ≈ 0.51, H ≈ 2.19) — concentration and H move together, positively: higher concentration ⇒ higher anonymity (mix), not lower (funnel).
• RQ3-P1-perf / RQ3-P1-latency / RQ3-P2 / RQ3-P3 — H0 (honest null). From the sealed live battery (3 selector arms × R=30 × C=50 = 4,500 real isolated-docker circuits, measured_from = live-docker-e2e; agent = qwen2.5:3b local Ollama; run-level multi-arm bootstrap, 10,000 BCa resamples, α = 0.05; results SHA-256 e09c66ef…):
• RQ3-P1-perf — FAILS the +10 pp gate. Throughput-retention margin = retention(agent) − max(static, random) = −0.6 pp, BCa 95% CI [−1.58 pp, +0.39 pp]. Every selector heals ~all churn drops (mean retention ≈ 0.99 across arms), so the agent shows no ≥ +10 pp gain.
• RQ3-P1-latency — WITHIN the ≤ 100 ms budget. Added-latency(agent) = median e2e latency(agent) − median latency(min-latency baseline = random) = −13.5 ms, BCa 95% CI [−52.1, +34.9] ms; CI upper 34.9 ms ≤ 100 ms — the agent is not slower than the best baseline (the perf gate, not latency, is what fails P1).
• RQ3-P2 — FAILS the ≤ 0.60 ceiling (fingerprint not excluded). Rebuild-classifier AUC (agent per-run mean inter-rebuild-gap vs. the pooled baseline selectors) = 0.587, BCa 95% CI [0.458, 0.703]; CI upper 0.703 > 0.60, so a rebuild-timing fingerprint of the agent cannot be ruled out at the pre-registered bar (the test is underpowered at n = 30 runs/arm). (Disclosure: the green §3-4 calibration gate reported AUC ≈ 0.93 — but that was churned-vs-low-churn regime discrimination on labelled control signals, a different comparison from this confirmatory agent-vs-baseline-selector AUC of 0.587; the calibration validated the instrument and does not preview the confirmatory selector value.)
• RQ3-P3 (joint) — H0. P1 fails (perf) and P2 fails → the agent selector is not confirmed to help without a fingerprint. Reported as the finding, not spun.
• Holm-7 (companion, authoritative). Over the frozen size-7 family {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}, exact Holm step-down (the RQ2-P3 slot carries the mechanism-corrected primary H1-pooled Spearman p, superseding the lead's degenerate as-instrumented RQ2-P3): survivors = RQ1-P1 (rank 1 ×7), RQ2-P1 shrink (rank 2 ×6), RQ2-P3 mix (rank 3 ×5) — all adjusted p = 0. Do not survive: RQ1-P2 (rank 4 ×4, adj p = 0.365), RQ3-P2 (rank 5 ×3, 0.511), RQ3-P1-perf (rank 6 ×2, 0.511), RQ3-P1-latency (rank 7 ×1, 0.511). (Holm adjusted p-values are step-down monotone-enforced — a later rank never reports a smaller adjusted p than an earlier one — so ranks 6–7 inherit the rank-5 value rather than their smaller bare rank-products; this is standard Holm, not an arithmetic slip.) This is the authoritative final correction and supersedes the lead paper's conservative partial embedding (report-4); both remain valid, the partial never under-corrects, and lead RQ1-P1 / RQ2-P1 survive regardless.

6. Discussion (both tracks UN-BLINDED)

• Does a shared bridge funnel or mix? — It mixes. Both pre-registered two-sided tests resolve positive (H1 ρ = +0.6244 CI [+0.5941, +0.6545]; H2 β = +0.7052 CI [+0.6195, +0.7903]; H3 RESOLVED = mix; Holm both reject). Plainly: concentrating circuits through a finite shared willing-bridge pool RAISES the per-circuit anonymity set — circuits that share a bridge share an exit signature, so the observation-consistent set grows and entropy rises. This refutes the naive funnel intuition (that concentration would shrink the set) and, per the mechanism developed in docs/note-unique-bridge-artifact.md, qualifies the lead RQ2-P1 "shrink" as a unique-bridge (fresh-bridge-per-circuit) instrument artifact: the lead topology assigned a fresh bridge per circuit seed, making every exit signature unique, every anonymity set size 1, and H≈0 by injective construction rather than by funnelling. Under a finite shared pool the injectivity is removed and the true sign of the concentration→anonymity relationship is revealed to be a mix. This is an honest qualification/correction of the lead reading via the frozen mechanism prereg (SHA-256 8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b), not an overwrite: the lead RQ2-P1 result and its frozen prereg stand as published and are not re-litigated.
• Mandatory disclosure (pre-registration honesty). The §7 calibration dry-pass — synthetic, offline, no confirmatory record read — already previewed this direction (Spearman ρ running 0 → +0.838 across the sweep, B=1 boundary at high entropy). The confirmatory battery therefore quantifies a dose-response that was already visible at calibration; the pre-committed hypotheses were nonetheless two-sided and that pre-commitment is unchanged. We surface the calibration preview openly so no reader mistakes the confirmatory sign for a post-hoc choice.
• Does the agent selector help without leaking? — No (H0), on both counts. RQ3-P3 requires the agent to clear the +10 pp retention / ≤ 100 ms latency bar and leave a non-classifiable rebuild pattern (AUC CI upper ≤ 0.60); it does neither decisively. On performance, the honest reason is that churn at kp = 30 / steps = 20 is fully healed by every arm — static, random, and the agent all rebuild ~all dropped hops (retention ≈ 0.99), so there is simply no headroom for an adaptive selector to win the +10 pp margin (margin −0.6 pp, CI [−1.58, +0.39] pp). The agent is not worse — added-latency is within budget (−13.5 ms, CI upper 34.9 ms ≤ 100 ms) — it is merely not better, because the baseline is already at the retention ceiling on this grid. On anonymity, the rebuild-timing classifier reaches AUC 0.587 with CI upper 0.703 > 0.60, so the pre-registered bar to certify "no usable fingerprint" is not met: at n = 30 runs/arm the test is underpowered to exclude a small rebuild-timing signal, and we report that limitation rather than a false all-clear. The honest reading: on this lab grid the local open-weight agent selector neither beats the baselines nor is demonstrably fingerprint-free — a null on both P1 and P2, exactly the outcome the design pre-committed to publish with equal prominence.
• Authoritative multiplicity (Holm-7). With all seven pre-registered p-values now in hand, the companion's exact Holm-7 supersedes the lead paper's conservative partial embedding (operator decision D3). Three hypotheses survive: RQ1-P1 (below-chance linkability AUC — no usable entry↔exit leak), RQ2-P1 (federation shrinks the anonymity set, the lead headline null), and RQ2-P3 (shared-pool concentration mixes — the mechanism correction). The four that do not survive are RQ1-P2 (padding efficacy), and all three RQ3 tests — consistent with the RQ3 H0 above. Note the RQ2-P3 slot now carries the mechanism-corrected primary statistic (H1-pooled Spearman, adj p = 0) rather than the lead's degenerate as-instrumented RQ2-P3 (adj p = 1): the companion's frozen-detector method both caught the unique-bridge artifact and promotes the corrected mechanism finding into the surviving family. Lead RQ1-P1 and RQ2-P1 survive regardless.
• Scope & limitations. Both findings are scoped to the lab grid (1-house / bridge-off control, single-laptop isolated-docker, two non-forwarding phones, self-generated fixture traffic) and inherit the lead paper's external-validity caveats. Specific to this companion: (i) the RQ2-P3 mix is an as-instrumented concentration effect on the ratified exit-signature posterior, not an internet-scale claim; (ii) the RQ3 nulls are grid-bound — the perf null follows from a baseline retention ceiling under the pinned churn, and the P2 non-exclusion is an n = 30 power limitation, not a proof of a fingerprint; (iii) the agent arm carries the accepted reproducibility caveat (Ollama temp-0 is reproducible via the committed decision-log + (seed, state-hash) cache replay, not via cross-hardware model re-execution), stated with equal prominence to the RQ1 timing caveat.

References

Inherit the lead paper's reference list (docs/stage-07-paper-draft.md §References) unchanged. The companion cites only references already grounded in the frozen sources: Chaum1981, Serjantov2002, Diaz2002, Egners2012, NasrBH18, OhYMH22, SirinamIJW18, RahmanSMGW20, Danezis2003 are in the lead paper's list; Barton2025 (CLASI rebuild/timing-classifier spirit) is grounded in the frozen lead prereg's RQ3 dependent-variable definition (sor-consent-prereg.md §3) and carries into the companion's assembled list. No reference is added that cannot be grounded from the frozen prereg or stage-01 literature.