# Stage-05 analysis clarification — RQ2 per-circuit adversary sender-posterior

**Status: PROPOSED — operator (Andre) ratification PENDING. NOT ratified; does
NOT edit the frozen prereg** (`sor-consent-prereg.md`, SHA
`f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`).

**Pre-specified BLIND to RQ2 outcomes — drafted 2026-07-20**, while the confirmatory
battery is still running and **no RQ2 confirmatory statistic (RQ2-P1/P2/P3) has been
computed, inspected, or reported.** This is honest *pre-registration completion* of a
specification gap the frozen prereg left open — not HARKing (no RQ2 result has been
seen; the rule is fixed before any RQ2 number exists).

> Distinction from the Holm clarification: that note **restated** a decision the
> prereg already fixes (family size 7). This note **fills a genuine gap** — the
> prereg pins the RQ2 DV as a *per-circuit adversary posterior* but gives no
> explicit construction formula. It therefore requires **operator ratification**
> before any RQ2 confirmatory number may be computed.

## The gap

The frozen prereg fixes the RQ2 dependent variable as a **per-circuit** quantity:

- **§3 (Variables), RQ2 DV:** *"Shannon entropy of the **adversary's posterior over
  candidate senders per circuit**; effective set size S = 2^H per [Serjantov2002],
  normalized d = H/log2(N) per [Diaz2002]. Estimator: plug-in (MLE) entropy with
  **Miller–Madow** bias correction; 95% CI by **bootstrap over circuits**."*
- **§4 (Sampling), unit of analysis:** *"RQ2 — the circuit (entropy of the
  per-circuit sender posterior)."*
- **§6 (Analysis), RQ2-P3:** Spearman ρ between top-k=3 bridge concentration and
  **per-circuit H** — which *requires a per-circuit H value to exist.*

What the prereg does **not** give is the **construction rule**: how, from one
observed confirmatory circuit, the adversary's posterior over candidate senders is
formed. The cited papers supply the **metric** (entropy of the posterior) and the
**normalizations** (S = 2^H, d = H/log2 N) — not the posterior itself. The built
instrument (executor `ce68d41`) currently records only a per-*run* Shannon entropy
of the realized entry-node **frequency**, which is a different quantity and yields
no per-circuit H (so RQ2-P3 is uncomputable as-collected). This note proposes the
missing construction, grounded in the cited literature only.

## Proposed construction (adversary sender-posterior, per circuit)

**Adversary model (as in [Serjantov2002], a global passive adversary over the lab
grid).** For each confirmatory circuit *i*, the adversary observes the circuit's
**exit segment and the federation-path structure it implies** — i.e. the
exit-bridge / exit-house through which the circuit leaves the federation. It does
**not** observe the true entry node (that is the anonymity the metric quantifies).

**Candidate senders = the observation-consistent anonymity set** \(A_i\): the set
of consenting entry-node candidates whose paths are **consistent with the observed
exit-bridge/house** under the cell's topology. Concretely:

- **1-house-N arm:** no federation observation narrows the pool — every one of the
  \(N\) consenting nodes in the single house is consistent ⇒ \(A_i\) = all \(N\).
- **bridge-federated / directory-federated arms:** the observed exit bridge/house
  partitions candidates — \(A_i\) is the subset of consenting senders whose
  federation path can reach the observed exit under the split-knowledge topology
  (R6 `select_federated_path` / directory constraints). Bridge concentration
  (few willing bridges carrying many circuits) narrows \(A_i\); a well-spread
  federation widens it. **The sign of this effect is not presumed** (§6 two-sided).

**Mass rule (the §-consistent default): uniform over \(A_i\).** With no side
information distinguishing candidates in \(A_i\), the maximum-entropy posterior is
uniform — the standard [Serjantov2002]/[Diaz2002] anonymity-set assumption. The
per-circuit posterior count vector is therefore \([1,1,\dots,1]\) of length
\(m_i = |A_i|\).

**Per-circuit entropy (Miller–Madow, bits):**
\[
H_i = \widehat{H}_{\mathrm{MM}}\big(\underbrace{[1,\dots,1]}_{m_i}\big)
     = \log_2 m_i + \frac{m_i-1}{2\,m_i\ln 2},
\]
using the existing `stats.miller_madow_entropy_bits`. Effective set size
\(S_i = 2^{H_i}\) [Serjantov2002]; normalized degree \(d_i = H_i / \log_2 N\)
[Diaz2002], \(N\) = matched total consenting nodes. Variation in \(H_i\) **across
circuits** (different circuits route through different bridges/houses ⇒ different
\(m_i\)) is the distribution that the frozen "**bootstrap over circuits**" resamples.

This makes the two frozen RQ2 confirmatory tests computable **offline** from the
immutable raw records (no re-run, no new traffic):

- **RQ2-P1 (ΔH, two-sided):** \(\Delta H = \mathrm{mean}_i H_i(\text{federated}) -
  \mathrm{mean}_i H_i(\text{single-house, matched } N)\), BCa 95% CI by bootstrap
  over circuits (`confirm.rq2_p1_delta_h`). **grow** if CI > 0, **honest-shrink**
  (reported with equal prominence) if CI < 0, **inconclusive** if it spans 0.
- **RQ2-P3 (mechanism):** Spearman ρ between per-circuit top-3 bridge concentration
  \(c_i\) and per-circuit \(H_i\), BCa 95% CI (`confirm.rq2_p3_funnel`); negative ρ
  quantifies funnelling.

## Offline recomputability (why the running battery is not wasted)

Every input above is recoverable from the **immutable** raw records the executor
already writes — the rule is applied *after* the fact, not during collection:

- `battery-results.json` → `runs[].per_circuit_seeds` gives each circuit's seed;
- `assemble(cell, cseed)` is **deterministic** ⇒ reproduces each circuit's
  `CircuitSpec` (path hops, house labels, bridge used, topology, consenting pool);
- from that spec the **observation-consistent set \(A_i\)** and top-3 concentration
  \(c_i\) are derived by the (proposed) offline loader — no live circuit needed.

So under this rule RQ2-P1/P3 are computed once, post-battery, from the sealed data.

## Honesty / anti-HARKing safeguards

1. **Blind:** fixed 2026-07-20 with the battery still running and **zero** RQ2
   confirmatory numbers computed or seen. The rule cannot be reverse-engineered
   from a result that does not yet exist.
2. **Frozen prereg untouched:** the rule lives only here, PROPOSED, until sign-off.
3. **Sign not presumed:** ΔH is two-sided; a shrink (federation *reduces* the
   anonymity set) is a publishable honest null, reported as prominently as growth.
4. **Detectors unchanged:** reuses the §5-calibrated `miller_madow_entropy_bits`
   (gate item 4: H = log2(N) for N equiprobable senders); no per-cell tuning.
5. **Cited-literature grounding only:** entropy-as-anonymity [Serjantov2002],
   normalized degree [Diaz2002]; uniform-over-anonymity-set is their standard model.

## Operator decision required

Ratify (or amend) the **observation-consistent-set + uniform-mass** construction
above. On ratification this note flips to RATIFIED and the offline RQ2 loader
(mirroring `confirm_load.py`'s RQ1 path) computes RQ2-P1/P3 once from the sealed
records. **Until then RQ2 stays BLIND — no RQ2 confirmatory statistic is computed,
inspected, or reported.**

### Citations
- **[Serjantov2002]** Serjantov, A., & Danezis, G. (2002). Towards an Information
  Theoretic Metric for Anonymity. *PET 2002*, LNCS 2482, 41–53.
  https://doi.org/10.1007/3-540-36467-6_4
- **[Diaz2002]** Díaz, C., Seys, S., Claessens, J., & Preneel, B. (2002). Towards
  Measuring Anonymity. *PET 2002*, LNCS 2482, 54–68.
  https://doi.org/10.1007/3-540-36467-6_5