# Companion Methods (BLIND scaffold): The Unique-Bridge / Mix Mechanism (RQ2-P3) and Churn-Resilient Agent Selection (RQ3) **Draft — companion methods, written BLIND. Results/Discussion HELD until each track clears its human gate.** > **Paper-structure note (deliberately left OPEN).** Whether this material ships as a second > standalone paper, as extension sections folded into the lead paper > (`docs/stage-07-paper-draft.md`), or as a short mechanism note is an **operator editorial > decision** and is **not** pre-committed here. The two methods tracks below are therefore > written as **self-contained sections** that can be lifted into either structure. > > **Blinding & gating status (binding).** > - **RQ2-P3 mechanism study** — the prereg (`docs/rq2p3-mechanism-prereg.md`, own slug > `sor-consent-rq2p3`) is **NOT YET FROZEN** (§10 empty). Its methods section below is marked > **FREEZE-PENDING**; **no confirmatory cell** runs until the operator records the SHA-256 in > §10 and signs off. > - **RQ3 companion** — hypotheses, gates, and analysis are **already frozen** in the lead prereg > (`sor-consent-prereg.md`, SHA-256 > `f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`, §3/§4/§6); the two open > `[APPROVAL]` execution params were pinned blind in `docs/rq3-companion-run-brief.md`. **No > confirmatory battery** runs until operator-GO on a live isolated grid (the added-latency DV is > live-only). > - **All Results / Discussion below are HELD-BLIND placeholders.** The **only** numbers written > here are already-produced **calibration-gate** values, and every one is labelled *calibration*, > never a confirmatory result. The frozen lead prereg is authoritative and **unedited**. --- ## Abstract *(skeleton — HELD-BLIND; quantitative confirmatory claims withheld until each gate clears)* The lead study measured a consent-gated, federated, nested-SSH relay instrument and reported two honest non-confirmations: no measurable entry↔exit linkability leak (RQ1) and a Holm-significant **shrink** of the per-circuit anonymity set under federation (RQ2-P1). This companion pursues the two questions the lead paper could not close. **First (RQ2-P3′, a mechanism study):** the lead "shrink" may be an **instrument artifact** — the bridge-federated topology assigns a *fresh* willing bridge per circuit seed, so every adversary-observable exit signature is unique, every anonymity set collapses to size 1, and entropy is driven to ≈0 by construction rather than by funnelling. We re-instrument the willing-bridge layer as a **finite shared pool** with skewed willingness and treat bridge **concentration as a manipulated independent variable** (a 3×3 dose-response over pool size and skew), asking **two-sided** whether concentration *reduces* (funnel) or *raises* (mix) the anonymity set. **Second (RQ3, churn resilience):** we measure whether a **local open-weight agent** path-selector (`qwen2.5:3b`) retains throughput and adds tolerable latency under a pinned churn schedule, without leaving a classifiable **rebuild fingerprint**. Both tracks are pre-registered, detector-frozen, and calibration-gated before any confirmatory cell. *(Confirmatory findings withheld: RQ2-P3 pending freeze; RQ3 pending operator-GO on the live grid.)* --- ## 1. Introduction (deltas beyond the lead paper) The lead paper (G4 + RQ1 + RQ2) established the consent-gate instrument and reported its linkability and anonymity-set readings. Two threads there were *raised but not resolved*, and this companion is scoped to exactly those. **(a) The unique-bridge / mix mechanism.** The lead RQ2-P1 result — federation **shrinks** the anonymity set (ΔH < 0) — was reported honestly, but the lead paper also flagged its RQ2-P3 mechanism test as **degenerate as-instrumented**: the bridge-federated arm assigns a fresh bridge per circuit seed, so top-3 bridge concentration is a constant `c_i = 1/C` with **zero variance** and Spearman ρ is undefined. The mechanistic reading (developed in `docs/note-unique-bridge-artifact.md`) is that the adversary's observable is an `exit_signature = (exit_house, bridge_label)`; a unique bridge per circuit makes every signature unique, so the observation-consistent anonymity set is size 1 and H≈0 **by injective construction, not by funnelling**. If that is right, a *finite shared* bridge pool should make circuits share signatures, enlarge the anonymity set, and act as a **mix** (concentration *raises* H) — the **opposite** of the naive funnel intuition. This makes RQ2-P3′ a test of whether the lead "shrink" headline is a unique-bridge artifact that a mechanism study can qualify or correct. This mix reading connects the consent-gate bridge to the classical mix [Chaum1981] and to information-theoretic set metrics [Serjantov2002; Diaz2002] the lead paper already adopts. **(b) Churn-resilient agent selection.** The lead paper held the selector at `static`; RQ3 asks whether an **adaptive** selector improves resilience when the relay pool churns. Two costs bound any such gain and are the confirmatory tension: (i) rebuilding a circuit after a dropped hop adds latency and can erode throughput, and (ii) the *timing pattern* of rebuilds is itself a side-channel — a rebuild-event classifier could fingerprint the selector, echoing website- and flow-fingerprinting results on onion transports [SirinamIJW18; RahmanSMGW20] and the rebuild/timing-classifier spirit of CLASI [Barton2025], and compounding statistical-disclosure exposure over repeated circuits [Danezis2003]. RQ3 therefore pairs a **performance** gate with an **anonymity** (non-fingerprint) gate: an agent selector only "helps" if it retains throughput at tolerable added latency **and** its rebuild pattern is not classifiable. ## 2. Related work (deltas) The lead paper's Related Work (onion routing / SOR [Egners2012], flow correlation [NasrBH18; OhYMH22], anonymity metrics [Serjantov2002; Diaz2002], social-trust G4 neighbours) is inherited unchanged. The companion adds two narrow deltas, citing **only** already-grounded references: - **Bridge-as-mix vs. bridge-as-funnel.** Concentrating flows through few willing bridges can be read either as a funnel (fewer distinct observation classes → smaller sets) or as a mix [Chaum1981] (shared observation class → larger sets). The set-size effect is quantified with the same entropy metrics the lead paper uses [Serjantov2002; Diaz2002]; the companion's contribution is a **manipulated-concentration dose-response** that adjudicates the sign, not a new estimator. - **Rebuild-timing as a fingerprint.** Churn-driven circuit rebuilds create a timing series an adversary may classify; this is the fingerprinting/timing lineage [SirinamIJW18; RahmanSMGW20; Barton2025] applied to *selector-induced* rebuild events rather than page loads. The companion adopts a **frozen, fixture-calibrated** rebuild classifier and reads its AUC as an instrument reading, mirroring the lead paper's frozen-correlator discipline (no correlator/classifier state-of-the-art is claimed). --- ## 3. Methods A — RQ2-P3′ funnelling-mechanism study **[FREEZE-PENDING (prereg §10 not yet signed)]** > **This section describes a study whose prereg (`docs/rq2p3-mechanism-prereg.md`) is NOT frozen.** > Design and parameters are operator-approved and locked; the **human freeze checkpoint** (SHA-256 > in §10 + sign-off) is outstanding. No confirmatory cell is run until then. Everything below is > the pre-registered *plan*; the calibration numbers cited are the pre-registered §7 gate output, > explicitly **not** confirmatory results. **Design (manipulated-IV dose-response).** A new assembler topology, `bridge-federated-pool`, replaces the fresh-per-seed bridge with a **finite willing-bridge pool** of size `B` under a fixed Zipf willingness skew `alpha`: `weights = zipf_weights(B, alpha)` derived from the **cell** seed (so the willingness profile is fixed within a run), and each circuit draws `idx = weighted_draw(sha256("sor-bridge-pool|{circuit_seed}"), weights)` → `bridge#{idx:02d}`, a label **reused** across circuits so concentration genuinely varies. Everything downstream (hop structure, houses, exit-signature grouping, Miller–Madow entropy, BCa bootstrap) is **identical** to the frozen lead pipeline; the lead `bridge-federated` branch is **untouched and bit-reproducible**. The manipulation grid is **B ∈ {2, 4, 8} × alpha ∈ {0 (uniform), 1.0, 2.0}** = 9 concentration cells; run order randomized within cell from an ordering seed distinct from the data seeds. **Hypotheses (two-sided; direction not presumed).** - **H1 (within-cell association).** Spearman ρ between per-circuit top-3 willing-bridge concentration `c_i` and per-circuit entropy `H_i`. **Funnel** iff BCa 95% CI < 0; **mix** iff CI > 0; **inconclusive** iff CI spans 0. - **H2 (dose-response).** OLS slope β of per-run mean-H on per-run mean top-3 concentration over 9 cells × 30 runs = 270 clustered points; cell-level BCa CI; funnel iff slope CI < 0, mix iff CI > 0. - **H3 (joint, direction-agnostic).** Mechanism **RESOLVED** iff H1 and H2 agree in sign and both exclude 0 — the *sign* (funnel vs mix) is the finding; **unresolved** if either spans 0. **Dependent variables.** Per-circuit `H_i` (Miller–Madow entropy of the uniform posterior over the observation-consistent anonymity set, inherited verbatim) and per-circuit top-3 concentration `c_i` (`confirm_load_rq2.bridge_concentration`, unchanged). **Sampling.** R = 30 seeded runs/cell, C = 50 circuits/run (matched to the lead study); base seed S0 = 20260719, per-cell seed `SHA256(S0 ‖ cell_id ‖ run_index)`; fixed stopping rule (all 9 cells × R to completion; uninformative cell → inconclusive; no optional stopping). **Analysis.** Effect size + BCa 95% CI (10,000 resamples, α = 0.05) for every test; **run-level cluster bootstrap** (resample whole runs, not circuits) because circuits sharing a bridge have identical `c_i` and correlated `H_i` — the same pseudo-replication defect the lead paper flagged for RQ1-P1. Holm–Bonferroni over **this study's own family** {H1-pooled, H2-slope}; the lead family-of-7 is closed and **not** reopened here. Any per-cell ρ contrast or ΔH replication is labelled **EXPLORATORY**, never a re-run of the frozen RQ2-P1. **Instrument-validation gate (§7, re-worded pre-freeze — cite `docs/stage-05-rq2p3-gate-clarification.md`).** The §7 items were **re-worded before freeze** because the original items 1–2 encoded the naive-funnel prior and were mechanically wrong under the ratified posterior (transparent deviation logged; no hypothesis changed — H1/H2/H3 stay two-sided). The re-worded gate validates the **instrument**, not a sign: 1. the **frozen** `bridge-federated` branch (not the pool) still shows the lead degeneracy — unique signatures → `m_i = 1` → `H_i ≈ 0`, constant `c_i = 1/C` (a pool draws with replacement and *cannot* reproduce the injective fresh-bridge degeneracy, so the regression teeth live on the untouched branch); 2. the **B = 1 boundary** yields `c = 1.0` (concentration tooth) **and**, under the ratified posterior, `H` at the **high** end (maximal mix) — the naive "low H" gloss is refuted by construction; 3. realized mean top-3 concentration is **monotone** (decreasing in B, increasing in alpha); 4. entropy calibration inherited (H = log₂N on equiprobable synthetic senders). A **§7 scope note** records that the gate **must not** pre-assert the H-vs-concentration sign — that sign *is* the two-sided confirmatory question; baking it in would be funnel-circular. **Pre-registered calibration finding (NOT a confirmatory result).** The dry §7 pass — synthetic, offline, no confirmatory record read — already **previews a mix**: across the sweep Spearman ρ runs from ≈0 up to **+0.838** (all cells ρ ≥ 0), the B = 1 boundary sits at high entropy (≈2.54 bits vs the fresh-bridge reference ≈0.0), and monotonicity + entropy calibration pass. This is surfaced **openly as a pre-registered calibration preview**, per the §7 scope note; it does **not** relax the two-sided pre-commitment, and the confirmatory sign remains withheld until after freeze. Honest disclosure the eventual write-up must carry: because the dry pass already previews the mix direction, the confirmatory battery **quantifies a dose-response already visible at calibration**; the two-sided pre-commitment stands and the lead RQ2-P1 headline is not re-litigated. ## 4. Methods B — RQ3 churn-resilient agent selector (frozen prereg) > Hypotheses, gates, DVs, and analysis are **frozen** in `sor-consent-prereg.md` (§3/§4/§6) and are > restated, not redefined. The two open `[APPROVAL]` execution params were pinned **blind** to RQ3 > outcomes (`docs/rq3-companion-run-brief.md` §2). **Design.** Selector strategy {`static`, `random`, `agent`} at the RQ3 control cell (single-house / bridge-off) under a pinned churn schedule; `static` is the interleaved control, and control runs are bracketed before and after the {`random`, `agent`} treatments to catch grid drift. The cells are enumerated **separately** from the frozen 6-cell lead lattice so the lead battery stays bit-reproducible. **Pinned execution parameters (blind).** - **Agent = `qwen2.5:3b`** via local Ollama (`agent_selector.OllamaAgentPolicy`, temperature 0, per-run seed, `(seed, state-hash)` decision cache, deterministic heuristic fallback on query failure). Local / open-weight, **$0**; the Claude/frontier arm (`ClaudeExploratoryPolicy`) stays **inert / EXPLORATORY / budget-gated** and is not wired. - **Reproducibility caveat (accepted; must be stated in the paper).** Ollama at temperature 0 is **not bit-identical across machines** (quantization / GPU logit drift). The agent arm is reproducible via the **committed decision-log + `(seed, state-hash)` cache replay**, *not* via independent model re-execution on other hardware — the same honesty class as the RQ1 timing caveat. The decision log + cache are committed as the reproducibility anchor. - **Churn = `kill_prob_pct = 30`, `steps = 20`**, one deterministic schedule per run seeded from the same `SHA256(S0 ‖ cell ‖ run)` family; low-churn calibration baseline `kill_prob_pct = 5`. **Dependent variables (frozen).** Throughput retention (throughput under churn / no-churn baseline); added latency = median end-to-end latency(agent) − median latency(best baseline arm), in ms — a **live** measurement only; and rebuild-classifier AUC over the rebuild-event time series (the per-run mean inter-rebuild-gap signal), per the [Barton2025] CLASI spirit. **Confirmatory gates (frozen, family-of-7).** | Test | Frozen gate | |---|---| | RQ3-P1-perf | throughput-retention(agent) − max(static, random): 95% CI lower bound **≥ 10 pp** | | RQ3-P1-latency | added-latency(agent): 95% CI upper bound **≤ 100 ms** | | RQ3-P2 | rebuild-classifier AUC: 95% CI upper bound **≤ 0.60** | | RQ3-P3 | logical AND: **CONFIRM** iff P1 ∧ P2 (perf gain *without* a rebuild fingerprint); else H0 | R = 30 runs/cell, C = 50 circuits/run, fixed stopping rule (inherited unchanged). **Analysis + multiplicity (Holm-7 supersedes note).** The three RQ3 tests were always in the frozen size-7 family {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}. Once all seven p-values exist, the companion computes the **exact Holm-7** step-down over the whole family; this is the **authoritative** final correction and **supersedes** the lead paper's deliberately conservative *partial* embedding (7/6/5/4 report-4) — both remain valid, the partial never under-corrects, and the lead paper's already-published RQ1-P1 / RQ2-P1 survive regardless (their reported raw p ≈ 0 — a lead-paper result, not a companion figure). Effect size + BCa 95% CI for every test; nulls reported honestly (a selector that does **not** beat baselines, or a rebuild pattern that **is** classifiable, is the finding). The QUIC / `ssh3` transport arm stays **EXPLORATORY and deferred** (design decision D3), never in the Holm family. **Calibration gates (already green; NOT confirmatory results).** Two boolean gates block the RQ3 confirmatory battery and have both passed on a **dry, synthetic, offline** pass: - **Churn-bites** — at the pinned `kp = 30 / steps = 20` the churn genuinely bites (non-zero drops/rebuilds across every RQ3 cell), so the retention and classifier tests are not degenerate. - **Rebuild-classifier calibration** — churned (`kp = 30`) vs low-churn baseline (`kp = 5`) is **separable** on the per-run mean inter-rebuild-gap signal (calibration AUC ≈ **0.93**), while baseline-vs-baseline is **not** (null AUC ≈ **0.52**); plus an agent cache-replay reproducibility check and the inherited entropy calibration. These are **calibration** readings on labelled control signals, **not fit to confirmatory cells**; the frozen instrument (`rebuild_interval_gaps`, `rebuild_classifier_auc`) is unchanged. --- ## 5. Results *(HELD-BLIND — no confirmatory number written)* - **RQ2-P3′ (H1 / H2 / H3).** *HELD — pending prereg freeze (§10) and the confirmatory run.* No Spearman ρ, OLS slope, CI, or Holm decision is computed or inspected until after freeze. *(The only figures on record are the §4/§3-A pre-registered **calibration** preview — ρ 0→+0.838, B=1 high-H — explicitly labelled calibration, not a result.)* - **RQ3-P1-perf / RQ3-P1-latency / RQ3-P2 / RQ3-P3.** *HELD — pending operator-GO on the live isolated grid.* Throughput-retention margin, added-latency (live-only), and rebuild-classifier AUC over confirmatory cells are **not** computed; the only figures on record are the two green **calibration** gates (churn-bites; classifier AUC ≈0.93 sep / ≈0.52 null), labelled calibration. - **Holm-7 (companion, authoritative).** *HELD* until all seven confirmatory p-values exist. ## 6. Discussion *(HELD-BLIND — placeholders)* - **Does a shared bridge funnel or mix?** *HELD.* If H1/H2 confirm **mix** (ρ, slope > 0), the companion qualifies the lead "shrink" as partly a unique-bridge artifact; if **funnel** (< 0), the lead reading is mechanistically corroborated; if inconclusive, the mechanism stays open. The sign is the finding; the lead RQ2-P1 result is reported as-is and not re-litigated. - **Does the agent selector help without leaking?** *HELD.* RQ3-P3 confirms only if the agent both clears the +10 pp retention / ≤100 ms latency bar **and** leaves a non-classifiable rebuild pattern (AUC CI upper ≤ 0.60); either failure is an honest H0 (perf cancelled by teardown overhead, or the rebuild timing is a usable fingerprint). - **Scope & limitations.** *HELD* — will inherit the lead paper's lab-grid external-validity scope, add the RQ2-P3 as-instrumented concentration/mix caveat, and carry the RQ3 agent-reproducibility caveat (cache-replay, not cross-hardware re-execution) with equal prominence. --- ## References Inherit the lead paper's reference list (`docs/stage-07-paper-draft.md` §References) unchanged. The companion cites only references already grounded in the frozen sources: **Chaum1981, Serjantov2002, Diaz2002, Egners2012, NasrBH18, OhYMH22, SirinamIJW18, RahmanSMGW20, Danezis2003** are in the lead paper's list; **Barton2025** (CLASI rebuild/timing-classifier spirit) is grounded in the frozen lead prereg's RQ3 dependent-variable definition (`sor-consent-prereg.md` §3) and carries into the companion's assembled list. No reference is added that cannot be grounded from the frozen prereg or stage-01 literature.