SS4: data-independent lead-paper draft (G4+RQ1+RQ2), written blind

docs/stage-07-paper-draft.md — Abstract skeleton, Intro (consent-gate novelty
G4 + RQ1 bridge-leak / RQ2 funnelling motivation), Related Work, full Methods
from the frozen prereg §2-§6, Limitations §7, References. Results/Discussion are
HELD-BLIND placeholders (battery still running, zero confirmatory numbers seen);
RQ2 subsections additionally gated on the pending posterior-construction
ratification. Frozen prereg untouched; no RQ2 statistic computed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/stage-07-paper-draft.md

@@ -0,0 +1,350 @@
+# Consent-Gated Federated Onion Routing: Linkability and Anonymity-Set Effects of an In-Band Accept/Reject Relay Model
+
+**Draft — SS4 lead paper (G4 + RQ1 + RQ2). DATA-INDEPENDENT SECTIONS ONLY.**
+
+> **Blinding status (prereg §2, binding).** This draft was written while the confirmatory
+> battery was still running and **before any confirmatory intermediate result was inspected.**
+> All Results / Discussion content is therefore held as empty placeholders and will be filled
+> **once, after the full battery completes** and the raw outputs are sealed (stage-05
+> immutability). The frozen prereg
+> (`sor-consent-prereg.md`, SHA-256
+> `f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`) is authoritative and
+> unedited.
+>
+> **RQ2 caveat (hard hold).** The RQ2 dependent variable — a *per-circuit adversary sender
+> posterior* — has a construction gap the frozen prereg leaves open (see
+> `docs/stage-05-rq2-posterior-clarification.md`, **PROPOSED, operator-ratification pending**).
+> **No RQ2 confirmatory statistic is computed, inspected, or reported in this draft.** RQ2
+> methods text below is hedged accordingly; RQ2 result content stays empty until the posterior
+> construction is ratified AND the battery completes.
+
+---
+
+## Abstract *(skeleton — quantitative claims held until data + RQ2 ratification)*
+
+Onion-routing systems typically admit any relay that meets a directory's technical criteria;
+they do not model **relay consent** — a host's in-band, per-circuit choice to carry a given
+flow. We build and measure a **consent-gated, federated, nested-SSH relay data plane** in which
+every hop must explicitly accept or reject each circuit through a signed in-band handshake
+(Ed25519-authenticated, X25519 per-hop credentials), and in which relays are organized into
+**houses** that federate either through a shared **bridge** or through a **directory**. Treating
+this as a *measurement instrument* for a trust model's exposure (not a service that provides
+anonymity), we ask two confirmatory questions on a lab grid of two phones and a laptop: **(RQ1)**
+does a shared bridge introduce a measurable flow-linkability leak between a circuit's entry and
+exit segments, and does cover padding remove it; **(RQ2)** does federating relays across houses
+**grow or shrink** the anonymity set an adversary faces, and is any effect explained by
+**bridge-concentration funnelling**. All detectors are frozen and calibrated on
+known-linked/known-unlinked and equiprobable-sender fixtures before any confirmatory cell is run;
+all inference is bootstrap-based with BCa 95% CIs, Holm–Bonferroni-corrected across the
+confirmatory family. **[RESULTS — HELD BLIND.]**
+
+---
+
+## 1. Introduction
+
+Anonymous-communication systems from onion routing [Reed1997; Dingledine2004] to its SSH-based
+descendant SOR [Egners2012] share a membership model that is essentially *permissionless at the
+relay*: a node participates if it meets directory or protocol criteria, and the routing layer
+does not represent whether a host **consents** to carry a particular circuit. Yet in
+social-trust and friend-to-friend designs — Freenet [Clarke2000], membership-concealing overlays
+[Vasserman2009], and social-graph routers such as Pisces [Mittal2012] and X-Vine [Mittal2012b] —
+*who is willing to relay for whom* is a first-class property. No existing system, to our
+knowledge, makes **per-circuit relay consent an in-band, cryptographically-authenticated protocol
+step** and then **measures the privacy consequences** of that gate. That gap — an
+accept/reject relay model whose linkability and anonymity-set behaviour are empirically
+characterised — is the novelty this work targets (**G4**).
+
+We do not propose consent-gating as a deployed anonymity service. We build it as a
+**defensive-measurement instrument**: a controlled data plane whose knobs (bridge on/off, cover
+padding, federation topology) let us *measure* how a consent gate reshapes an adversary's view.
+Two consequences of the gate are non-obvious and testable:
+
+1. **A shared bridge is a linkability hazard (RQ1).** When federated houses route through one
+   shared bridge node, that node observes both the entry and exit segments of circuits crossing
+   it. Modern flow-correlation attacks link such segments at high accuracy from timing/volume
+   alone [NasrBH18; OhYMH22; RahmanSMGW20]. We ask whether our bridge exhibits a **measurable**
+   entry↔exit correlation leak, and whether **cover padding** closes it.
+
+2. **Consent-gating can funnel, not just spread (RQ2).** Federation intuitively enlarges the
+   candidate-sender set and thus anonymity [Serjantov2002; Diaz2002]. But a consent gate means
+   only *willing* relays carry traffic; if willingness concentrates on a few bridges, circuits
+   funnel through them and the effective anonymity set may **shrink**. We therefore treat the
+   sign of the federation effect as **unknown a priori** and report a shrink as prominently as a
+   growth.
+
+**Contributions.** (i) The design and instrument-grade implementation of a consent-gated,
+federated, nested-SSH relay data plane with signed in-band accept/reject and per-hop X25519
+credentials (§3, §4). (ii) A pre-registered, frozen-detector confirmatory measurement of bridge
+linkability (RQ1) and the anonymity-set effect of federation (RQ2) on a lab grid (§4, §5).
+(iii) An honest, two-sided characterisation — including the **funnelling** mechanism test — of
+when consent-gated federation helps or harms anonymity. **[Quantitative findings — HELD BLIND.]**
+
+**Scope.** Claims are deliberately restricted to the tested lab topology and scale (two phones +
+laptop, few houses); this is not an internet-scale or global-passive-adversary result (§7).
+The paired **churn-resilience** question (RQ3) and a QUIC/`ssh3` transport arm [Michel2023] are
+pre-registered but held for a companion paper; this lead paper covers G4 + RQ1 + RQ2 only.
+
+---
+
+## 2. Related work
+
+**Onion routing and SSH-based relays.** Mixes and onion routing originate with Chaum [Chaum1981]
+and Reed–Syverson–Goldschlag [Reed1997], with Tor [Dingledine2004] as the dominant deployment.
+SOR [Egners2012] is the **direct prior art**: it layers onion routing over stock SSH tunnels,
+which is exactly our transport substrate. Nesting SSH inside SSH raises the well-known
+TCP-over-TCP throughput/latency pathology [Honda2005], motivating our latency-aware measurement
+and a (exploratory) QUIC-based `ssh3` transport [Michel2023]; UDP-based latency work on onion
+services [AlAzad2023] is complementary. **None of these model per-circuit relay consent**, which
+is the axis we add and measure.
+
+**Flow correlation / linkability (RQ1).** That an adversary seeing two segments of a flow can
+link them is established: low-cost traffic analysis [MurdochD05], realistic-adversary correlation
+on Tor [JohnsonWJSS13], and deep-learning correlators DeepCorr [NasrBH18] and DeepCoFFEA
+[OhYMH22] achieve high linking accuracy; packet-timing (Tik-Tok [RahmanSMGW20]) and deep
+fingerprinting [SirinamIJW18] show timing/volume suffice. We do **not** advance correlator
+state-of-the-art; we adopt a **frozen, fixture-calibrated** correlator (calibration gate §5) and
+use its AUC purely as an *instrument reading* of whether our bridge leaks — the contribution is
+the consent-gate/bridge measurement, not the attack.
+
+**Anonymity metrics and Sybil/directory concerns (RQ2).** We quantify anonymity with the
+information-theoretic set metrics of Serjantov–Danezis [Serjantov2002] (entropy of the adversary
+posterior; effective set size S = 2^H) and Díaz et al. [Diaz2002] (normalized degree
+d = H/log₂N). Federation across mutually-distrusting houses evokes decentralised-directory and
+Sybil questions [Douceur2002; Winter2016] and statistical-disclosure exposure over repeated
+circuits [Danezis2003]. Our **matched-N** design isolates the *topology* effect (federated vs.
+single-house at equal total node count) rather than a node-count artifact.
+
+**Social-trust / consent-adjacent designs (G4 neighbours).** The closest neighbours treat
+relaying willingness or social linkage as structural: Freenet's friend-to-friend mode
+[Clarke2000], membership-concealing overlays [Vasserman2009], Drac's social low-volume comms
+[Danezis2010], and social-graph routers Pisces [Mittal2012] / X-Vine [Mittal2012b] / STor
+[Zhou2011]. These encode *trust in the graph*; **none makes consent an in-band, per-circuit,
+signed accept/reject protocol step whose linkability and anonymity-set consequences are then
+measured** — the specific gap G4 fills.
+
+---
+
+## 3. System design (the instrument)
+
+The instrument is a nested-SSH relay data plane built into an existing zero-knowledge chat relay
+(hack-house), entirely within an isolated worktree. It has seven components (roadmap R1–R7); the
+subset load-bearing for this lead paper (RQ1 + RQ2, `static` selector, no model) is fully pinned
+by the freeze. Key mechanisms:
+
+- **Consent handshake (R5).** Each hop receives a signed in-band consent *request* and must
+  **accept or reject** before it will carry the circuit. Requests are **Ed25519-signed** by the
+  originating persona and **verified before acceptance**; an unsigned or forged request is
+  rejected. Per-hop credentials are **X25519-sealed to the host's public key**, so a hop
+  credential decrypts *only* with that host's private key (no shared-symmetric secret).
+- **Nested-SSH circuits (R4).** A circuit is a chain of SSH tunnels across grid hops; the entry
+  and exit **segments** are the observable units for RQ1. Every hop's traffic is captured to an
+  immutable per-hop pcap, written once and checksummed.
+- **Federation / bridge (R6).** Relays are grouped into **houses**. Houses federate via a shared
+  **bridge** node or via a **directory**; a circuit's federation path is chosen under
+  split-knowledge topology constraints. The bridge is the shared observation point RQ1 probes and
+  the concentration point RQ2's funnelling test probes.
+- **Determinism & provenance (R1–R3).** All stochastic behaviour derives from a single
+  `--sor-seed`; the seed, git SHA, and node-role→device mapping are echoed into an immutable
+  `manifest.json`, and every relay event is appended to a SHA-256-sealed `events.jsonl`.
+- **Containment (binding).** Every forwarder runs in an **isolated engine only**
+  (`assert engine != local` or the run refuses). All traffic is self-generated to our own
+  fixtures, lab-only. No external target, no live-network relay.
+
+---
+
+## 4. Methods (pre-registered; frozen)
+
+This study is a **confirmatory factorial controlled comparison**; the design, variables, seeds,
+detectors, and analysis were frozen and hashed on 2026-07-19 before any confirmatory cell ran.
+
+### 4.1 Design matrix
+
+Cells are organised per RQ with the other factors held at their declared control:
+
+- **RQ1 (linkability):** bridge ∈ {off, on, on+padding} — 3 levels; topology held at
+  single-house, selector `static`. (bridge-off+padding is declared **N/A** — padding is defined
+  only for bridge-on.)
+- **RQ2 (anonymity set):** topology ∈ {1-house-N, bridge-federated, directory-federated} at
+  **matched total node count N** — 3 levels; bridge held off, selector `static`.
+
+Full crossing is not run. Run order is randomised within each cell and the control arm is
+interleaved before and after treatments so grid calibration drift is caught. All stochastic
+elements are seed-controlled.
+
+### 4.2 Dependent variables
+
+- **RQ1 — correlation AUC.** Area under the ROC of the frozen flow-correlation detector scoring
+  (entry-segment, exit-segment) pairs as same/different circuit, measured from the real per-hop
+  pcaps. Unit of analysis: the **(entry, exit) pair**; 95% CI by **bootstrap over circuit
+  pairs**.
+- **RQ2 — anonymity-set entropy H.** Shannon entropy of the **adversary's posterior over
+  candidate senders per circuit**; effective set size S = 2^H [Serjantov2002], normalized
+  d = H/log₂N [Diaz2002]; **Miller–Madow** finite-sample bias correction; 95% CI by **bootstrap
+  over circuits**. Unit of analysis: the **circuit**. **ΔH = H(federated) − H(single-house,
+  matched N).**
+  > *Construction caveat (hard hold).* The prereg pins this DV as a per-circuit posterior but
+  > does not give the posterior **construction rule**. A construction — uniform mass over the
+  > observation-consistent anonymity set, grounded only in [Serjantov2002; Diaz2002] — is
+  > **PROPOSED** in `docs/stage-05-rq2-posterior-clarification.md` and **awaits operator
+  > ratification**. Until ratified, **no RQ2 number is computed.** The construction is
+  > recomputable **offline** from the sealed per-circuit seeds (deterministic circuit assembly),
+  > so the running battery is not wasted regardless of the ratified rule.
+
+### 4.3 Sampling & power
+
+**R = 30** independent seeded runs per cell; each run builds **C = 50** circuits (≥ 1500 scored
+pairs per cell for RQ1). The target is **precision, not a formal power analysis**: ≥ 1500 pairs
+yields an expected bootstrap 95% CI half-width on AUC ≤ 0.03, enough to resolve the RQ1 floor
+away from 0.5. One base seed **S0 = 20260719**; per-cell seed = `SHA256(S0 ‖ cell_id ‖ run_index)`
+truncated to u64, echoed into every manifest. **Stopping rule:** all cells × R runs run to
+completion — **no optional stopping, no interim looks**; an uninformative cell is reported
+**inconclusive**, never extended to chase significance.
+
+### 4.4 Frozen detectors and the instrument-validation gate
+
+Detectors (correlator, entropy estimator, classifier) are written and **calibrated only on the
+instrument-validation fixtures** — known-linked/known-unlinked control pairs and
+equiprobable-sender synthetic sets — **before any confirmatory cell is run**; **no per-cell
+tuning** is permitted. The battery ran only after all six boolean gate items passed green:
+(1) 3-hop end-to-end delivery with per-hop pcap + checksum; (2) seeded reproducibility (same seed
+→ identical circuit-build sequence); (3) correlator calibration (known-linked AUC ≈ 1,
+known-unlinked ≈ 0.5); (4) entropy calibration (H = log₂N for N equiprobable senders);
+(5) isolation (`assert engine != local` or refuse); (6) provenance integrity (replayed fixture →
+schema-valid `events.jsonl` whose SHA-256 matches the manifest; append-only).
+
+### 4.5 Analysis plan
+
+Effect size + 95% CI for **every** comparison; p-values never reported alone. All inference is
+bootstrap/permutation-based (10,000 resamples, **BCa** intervals; 3-seed spot-check to MC error).
+
+- **RQ1-P1 (leak).** Bridge-on correlation AUC, bootstrap 95% CI. **Confirmation gate = CI
+  excludes 0.5** (leak present); **null** if CI includes 0.5. Materiality is a *separate* label:
+  CI lower bound ≥ **0.60** ⇒ "material leak"; between 0.5 and 0.60 ⇒ "weak-but-real leak."
+- **RQ1-P2 (padding efficacy).** ΔAUC = AUC(bridge-on, no-pad) − AUC(bridge-on, +pad); **paired**
+  bootstrap 95% CI. Padding effective iff ΔAUC CI **> 0**.
+- **RQ2-P1 (federation effect, two-sided).** ΔH bootstrap 95% CI; **the sign is not presumed.**
+  **grow** if CI > 0; **honest shrink (reported with equal prominence)** if CI < 0;
+  **inconclusive** if it spans 0. *(Computation gated on RQ2 ratification.)*
+- **RQ2-P3 (funnelling mechanism).** Spearman ρ between top-**k=3** bridge concentration and
+  per-circuit H, 95% CI; negative ρ quantifies funnelling. *(Computation gated on RQ2
+  ratification.)*
+- **Multiple comparisons.** Holm–Bonferroni over the frozen **family of 7** confirmatory tests
+  {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}; the 4 lead-paper tests
+  are reported at Holm-adjusted multipliers 7, 6, 5, 4 (conservative embedding — see
+  `docs/stage-05-holm-clarification.md`, ratified). EXPLORATORY results (QUIC transport; any
+  post-hoc contrast) are labelled and excluded from the confirmatory column.
+- **Data exclusion (pre-data).** A run is quarantined (logged, never silently dropped) **only**
+  on a data-integrity failure (SHA mismatch, pcap checksum failure, in-place edit, or
+  non-reproducing seed). **No performance-based exclusions.**
+
+---
+
+## 5. Results *(HELD BLIND — placeholders)*
+
+> Populated **once**, after the full battery completes and raw outputs are sealed. RQ2 subsections
+> additionally gated on ratification of the posterior construction. No confirmatory number appears
+> until then.
+
+### 5.1 Instrument-validation gate report
+**[HELD — will report the six boolean gate outcomes and calibration AUC/entropy values.]**
+
+### 5.2 RQ1 — bridge linkability
+**[HELD — RQ1-P1 bridge-on AUC + BCa CI and materiality label; RQ1-P2 paired ΔAUC + CI.]**
+
+### 5.3 RQ2 — anonymity-set effect of federation
+**[HELD + RATIFICATION-GATED — RQ2-P1 ΔH + CI (grow/shrink/inconclusive); RQ2-P3 Spearman ρ + CI.]**
+
+### 5.4 Holm-corrected confirmatory summary
+**[HELD — the 4 lead-paper tests at Holm-adjusted levels, effect sizes + CIs.]**
+
+---
+
+## 6. Discussion *(HELD BLIND — placeholder)*
+
+**[HELD — interpretation of the confirmed/null/inconclusive outcomes; the honest-null story if
+ΔH shrinks; what the funnelling ρ implies for consent-gated federation; padding efficacy.]**
+
+---
+
+## 7. Limitations & threats to validity
+
+- **Scale / adversary model (External).** The grid is two phones + a laptop and few houses; this
+  is **not** internet-scale and **not** a global passive adversary. Claims are scoped to the
+  tested topology/scale; entropy CIs are wide at small node counts (accepted, node counts
+  reported).
+- **Construct.** Self-generated fixture traffic is not real user traffic (inherent to lab
+  measurement; fixtures versioned/checksummed). A single correlator's AUC stands in for
+  "linkability" and plug-in H for "anonymity" — mitigated by fixture calibration (§4.4) and by
+  reporting S = 2^H and normalized d; a second entropy estimator (NSB) is reported EXPLORATORY as
+  a sensitivity check.
+- **Internal.** Thermal/background load and device heterogeneity are mitigated by randomised
+  order, interleaved controls, per-session idle baselines, and a pinned node-role→device mapping.
+  Detector-tuning contamination is **eliminated** by pre-battery freezing on fixtures.
+- **RQ2 construction dependency.** The RQ2 result depends on the ratified posterior construction
+  (§4.2 caveat); the construction is pre-specified blind, two-sided, and grounded only in cited
+  metrics — but it is a specification the frozen prereg did not pin, and is disclosed as such.
+- **Dual-use (ethics).** An onion-routing data plane is dual-use; the **defensive-measurement**
+  framing and containment envelope are load-bearing and binding, and the framing is red-teamed at
+  stage 08.
+
+---
+
+## 8. Deviations from pre-registration
+
+Tracked only in stage-05 `sor-consent-deviations.md` (none edit the frozen prereg). Two
+clarifications recorded to date: the Holm family-size restatement
+(`docs/stage-05-holm-clarification.md`, **ratified**) and the RQ2 posterior construction
+(`docs/stage-05-rq2-posterior-clarification.md`, **PROPOSED — pending operator ratification**).
+
+---
+
+## References
+
+- **[Chaum1981]** Chaum, D. L. (1981). Untraceable Electronic Mail, Return Addresses, and Digital
+  Pseudonyms. *CACM* 24(2), 84–90. https://doi.org/10.1145/358549.358563
+- **[Reed1997]** Reed, M. G., Syverson, P. F., & Goldschlag, D. M. (1997). Anonymous Connections
+  and Onion Routing. *IEEE S&P 1997*, 44–54. https://doi.org/10.1109/secpri.1997.601314
+- **[Dingledine2004]** Dingledine, R., Mathewson, N., & Syverson, P. (2004). Tor: The
+  Second-Generation Onion Router. *USENIX Security 2004*.
+- **[Egners2012]** Egners, A., Gatzen, D., Panchenko, A., & Meyer, U. (2012). Introducing SOR:
+  SSH-based Onion Routing. *IEEE WAINA 2012*, 280–286. https://doi.org/10.1109/WAINA.2012.89
+- **[Honda2005]** Honda, O., et al. (2005). Understanding TCP over TCP. *SPIE 6011*.
+  https://doi.org/10.1117/12.630496
+- **[Michel2023]** Michel, F., & Bonaventure, O. (2023). Towards SSH3. arXiv:2312.08396.
+- **[AlAzad2023]** Al Azad, M. W., et al. (2023). DarkHorse. *IEEE LCN 2023*. arXiv:2307.02429.
+- **[MurdochD05]** Murdoch, S. J., & Danezis, G. (2005). Low-Cost Traffic Analysis of Tor.
+  *IEEE S&P 2005*, 183–195. https://doi.org/10.1109/SP.2005.12
+- **[JohnsonWJSS13]** Johnson, A., et al. (2013). Users Get Routed. *ACM CCS 2013*, 337–348.
+  https://doi.org/10.1145/2508859.2516651
+- **[NasrBH18]** Nasr, M., Bahramali, A., & Houmansadr, A. (2018). DeepCorr. *ACM CCS 2018*,
+  1962–1976. https://doi.org/10.1145/3243734.3243824
+- **[OhYMH22]** Oh, S. E., et al. (2022). DeepCoFFEA. *IEEE S&P 2022*, 1915–1932.
+  https://doi.org/10.1109/SP46214.2022.9833801
+- **[RahmanSMGW20]** Rahman, M. S., et al. (2020). Tik-Tok. *PoPETs* 2020(3).
+  https://doi.org/10.2478/popets-2020-0043
+- **[SirinamIJW18]** Sirinam, P., et al. (2018). Deep Fingerprinting. *ACM CCS 2018*, 1928–1943.
+  https://doi.org/10.1145/3243734.3243768
+- **[Serjantov2002]** Serjantov, A., & Danezis, G. (2002). Towards an Information Theoretic Metric
+  for Anonymity. *PET 2002*, LNCS 2482, 41–53. https://doi.org/10.1007/3-540-36467-6_4
+- **[Diaz2002]** Díaz, C., et al. (2002). Towards Measuring Anonymity. *PET 2002*, LNCS 2482,
+  54–68. https://doi.org/10.1007/3-540-36467-6_5
+- **[Douceur2002]** Douceur, J. R. (2002). The Sybil Attack. *IPTPS 2002*, LNCS 2429, 251–260.
+  https://doi.org/10.1007/3-540-45748-8_24
+- **[Danezis2003]** Danezis, G. (2003). Statistical Disclosure Attacks. *IFIP SEC 2003*.
+- **[Winter2016]** Winter, P., et al. (2016). Identifying and Characterizing Sybils in the Tor
+  Network. *USENIX Security 2016*, 1169–1185.
+- **[Clarke2000]** Clarke, I., et al. (2000/2001). Freenet. *Designing PETs*, LNCS 2009.
+  https://doi.org/10.1007/3-540-44702-4_4
+- **[Vasserman2009]** Vasserman, E. Y., et al. (2009). Membership-Concealing Overlay Networks.
+  *ACM CCS 2009*, 390–399. https://doi.org/10.1145/1653662.1653709
+- **[Danezis2010]** Danezis, G., et al. (2010). Drac. *PETS 2010*, LNCS 6205, 202–219.
+  https://doi.org/10.1007/978-3-642-14527-8_12
+- **[Mittal2012]** Mittal, P., Wright, M., & Borisov, N. (2012). Pisces. *NDSS 2013*.
+  arXiv:1208.6326.
+- **[Mittal2012b]** Mittal, P., Caesar, M., & Borisov, N. (2012). X-Vine. *NDSS 2012*.
+  arXiv:1109.0971.
+- **[Zhou2011]** Zhou, P., et al. (2011/2013). STor. arXiv:1110.5794.
+
+*(Full bibliography: `~/coding/sci-method/stages/01-literature/output/sor-consent-bibliography.md`.
+Integrity flags carried forward: [Stutzbach2006] secondary-sourced; [Constantinides2026] recent
+preprint — neither is load-bearing in this lead paper.)*