hack-house/docs/stage-07-companion-methods.md

Companion Methods (BLIND scaffold): The Unique-Bridge / Mix Mechanism (RQ2-P3) and Churn-Resilient Agent Selection (RQ3)

Draft — companion methods, written BLIND. Results/Discussion HELD until each track clears its human gate.

Paper-structure note (deliberately left OPEN). Whether this material ships as a second standalone paper, as extension sections folded into the lead paper (docs/stage-07-paper-draft.md), or as a short mechanism note is an operator editorial decision and is not pre-committed here. The two methods tracks below are therefore written as self-contained sections that can be lifted into either structure.

Blinding & gating status (binding).

• RQ2-P3 mechanism study — FROZEN + SEALED; its Results/Discussion are now UN-BLINDED below. The prereg (docs/rq2p3-mechanism-prereg.md, own slug sor-consent-rq2p3) was frozen 2026-07-21 (§10 signed; full-file SHA-256 8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b in the sidecar docs/rq2p3-mechanism-prereg.sha256). The confirmatory battery then ran offline + deterministic and its record is sealed (output/sor-rq2p3-confirmatory/…, results SHA-256 5fdcb379d8a2…). §5/§6 for RQ2-P3 are filled from that sealed record only, the same post-seal discipline the lead paper used.
• RQ3 companion — hypotheses, gates, and analysis are already frozen in the lead prereg (sor-consent-prereg.md, SHA-256 f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b, §3/§4/§6); the two open [APPROVAL] execution params were pinned blind in docs/rq3-companion-run-brief.md. No confirmatory battery runs until operator-GO on a live isolated grid (the added-latency DV is live-only).
• All Results / Discussion below are HELD-BLIND placeholders. The only numbers written here are already-produced calibration-gate values, and every one is labelled calibration, never a confirmatory result. The frozen lead prereg is authoritative and unedited.

---

Abstract (skeleton — HELD-BLIND; quantitative confirmatory claims withheld until each gate clears)

The lead study measured a consent-gated, federated, nested-SSH relay instrument and reported two honest non-confirmations: no measurable entry↔exit linkability leak (RQ1) and a Holm-significant shrink of the per-circuit anonymity set under federation (RQ2-P1). This companion pursues the two questions the lead paper could not close. First (RQ2-P3′, a mechanism study): the lead "shrink" may be an instrument artifact — the bridge-federated topology assigns a fresh willing bridge per circuit seed, so every adversary-observable exit signature is unique, every anonymity set collapses to size 1, and entropy is driven to ≈0 by construction rather than by funnelling. We re-instrument the willing-bridge layer as a finite shared pool with skewed willingness and treat bridge concentration as a manipulated independent variable (a 3×3 dose-response over pool size and skew), asking two-sided whether concentration reduces (funnel) or raises (mix) the anonymity set. Second (RQ3, churn resilience): we measure whether a local open-weight agent path-selector (qwen2.5:3b) retains throughput and adds tolerable latency under a pinned churn schedule, without leaving a classifiable rebuild fingerprint. Both tracks are pre-registered, detector-frozen, and calibration-gated before any confirmatory cell. (Confirmatory findings withheld: RQ2-P3 pending freeze; RQ3 pending operator-GO on the live grid.)

---

1. Introduction (deltas beyond the lead paper)

The lead paper (G4 + RQ1 + RQ2) established the consent-gate instrument and reported its linkability and anonymity-set readings. Two threads there were raised but not resolved, and this companion is scoped to exactly those.

(a) The unique-bridge / mix mechanism. The lead RQ2-P1 result — federation shrinks the anonymity set (ΔH < 0) — was reported honestly, but the lead paper also flagged its RQ2-P3 mechanism test as degenerate as-instrumented: the bridge-federated arm assigns a fresh bridge per circuit seed, so top-3 bridge concentration is a constant c_i = 1/C with zero variance and Spearman ρ is undefined. The mechanistic reading (developed in docs/note-unique-bridge-artifact.md) is that the adversary's observable is an exit_signature = (exit_house, bridge_label); a unique bridge per circuit makes every signature unique, so the observation-consistent anonymity set is size 1 and H≈0 by injective construction, not by funnelling. If that is right, a finite shared bridge pool should make circuits share signatures, enlarge the anonymity set, and act as a mix (concentration raises H) — the opposite of the naive funnel intuition. This makes RQ2-P3′ a test of whether the lead "shrink" headline is a unique-bridge artifact that a mechanism study can qualify or correct. This mix reading connects the consent-gate bridge to the classical mix [Chaum1981] and to information-theoretic set metrics [Serjantov2002; Diaz2002] the lead paper already adopts.

(b) Churn-resilient agent selection. The lead paper held the selector at static; RQ3 asks whether an adaptive selector improves resilience when the relay pool churns. Two costs bound any such gain and are the confirmatory tension: (i) rebuilding a circuit after a dropped hop adds latency and can erode throughput, and (ii) the timing pattern of rebuilds is itself a side-channel — a rebuild-event classifier could fingerprint the selector, echoing website- and flow-fingerprinting results on onion transports [SirinamIJW18; RahmanSMGW20] and the rebuild/timing-classifier spirit of CLASI [Barton2025], and compounding statistical-disclosure exposure over repeated circuits [Danezis2003]. RQ3 therefore pairs a performance gate with an anonymity (non-fingerprint) gate: an agent selector only "helps" if it retains throughput at tolerable added latency and its rebuild pattern is not classifiable.

2. Related work (deltas)

The lead paper's Related Work (onion routing / SOR [Egners2012], flow correlation [NasrBH18; OhYMH22], anonymity metrics [Serjantov2002; Diaz2002], social-trust G4 neighbours) is inherited unchanged. The companion adds two narrow deltas, citing only already-grounded references:

• Bridge-as-mix vs. bridge-as-funnel. Concentrating flows through few willing bridges can be read either as a funnel (fewer distinct observation classes → smaller sets) or as a mix [Chaum1981] (shared observation class → larger sets). The set-size effect is quantified with the same entropy metrics the lead paper uses [Serjantov2002; Diaz2002]; the companion's contribution is a manipulated-concentration dose-response that adjudicates the sign, not a new estimator.
• Rebuild-timing as a fingerprint. Churn-driven circuit rebuilds create a timing series an adversary may classify; this is the fingerprinting/timing lineage [SirinamIJW18; RahmanSMGW20; Barton2025] applied to selector-induced rebuild events rather than page loads. The companion adopts a frozen, fixture-calibrated rebuild classifier and reads its AUC as an instrument reading, mirroring the lead paper's frozen-correlator discipline (no correlator/classifier state-of-the-art is claimed).

---

3. Methods A — RQ2-P3′ funnelling-mechanism study [FROZEN 2026-07-21 — prereg §10 signed]

This section describes a study whose prereg (docs/rq2p3-mechanism-prereg.md) is FROZEN. Design and parameters were operator-approved and locked; the human freeze checkpoint (§10 signed 2026-07-21, full-file SHA-256 8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b in the sidecar docs/rq2p3-mechanism-prereg.sha256) is complete. The confirmatory battery then ran offline + deterministic and its record is sealed (results SHA-256 5fdcb379d8a2…). Everything below is the pre-registered plan exactly as frozen; the §5/§6 numbers are read from that sealed record only.

Design (manipulated-IV dose-response). A new assembler topology, bridge-federated-pool, replaces the fresh-per-seed bridge with a finite willing-bridge pool of size B under a fixed Zipf willingness skew alpha: weights = zipf_weights(B, alpha) derived from the cell seed (so the willingness profile is fixed within a run), and each circuit draws idx = weighted_draw(sha256("sor-bridge-pool|{circuit_seed}"), weights) → bridge#{idx:02d}, a label reused across circuits so concentration genuinely varies. Everything downstream (hop structure, houses, exit-signature grouping, Miller–Madow entropy, BCa bootstrap) is identical to the frozen lead pipeline; the lead bridge-federated branch is untouched and bit-reproducible. The manipulation grid is B ∈ {2, 4, 8} × alpha ∈ {0 (uniform), 1.0, 2.0} = 9 concentration cells; run order randomized within cell from an ordering seed distinct from the data seeds.

Hypotheses (two-sided; direction not presumed).

• H1 (within-cell association). Spearman ρ between per-circuit top-3 willing-bridge concentration c_i and per-circuit entropy H_i. Funnel iff BCa 95% CI < 0; mix iff CI

  0; inconclusive iff CI spans 0.

• H2 (dose-response). OLS slope β of per-run mean-H on per-run mean top-3 concentration over 9 cells × 30 runs = 270 clustered points; cell-level BCa CI; funnel iff slope CI < 0, mix iff CI > 0.
• H3 (joint, direction-agnostic). Mechanism RESOLVED iff H1 and H2 agree in sign and both exclude 0 — the sign (funnel vs mix) is the finding; unresolved if either spans 0.

Dependent variables. Per-circuit H_i (Miller–Madow entropy of the uniform posterior over the observation-consistent anonymity set, inherited verbatim) and per-circuit top-3 concentration c_i (confirm_load_rq2.bridge_concentration, unchanged).

Sampling. R = 30 seeded runs/cell, C = 50 circuits/run (matched to the lead study); base seed S0 = 20260719, per-cell seed SHA256(S0 ‖ cell_id ‖ run_index); fixed stopping rule (all 9 cells × R to completion; uninformative cell → inconclusive; no optional stopping).

Analysis. Effect size + BCa 95% CI (10,000 resamples, α = 0.05) for every test; run-level cluster bootstrap (resample whole runs, not circuits) because circuits sharing a bridge have identical c_i and correlated H_i — the same pseudo-replication defect the lead paper flagged for RQ1-P1. Holm–Bonferroni over this study's own family {H1-pooled, H2-slope}; the lead family-of-7 is closed and not reopened here. Any per-cell ρ contrast or ΔH replication is labelled EXPLORATORY, never a re-run of the frozen RQ2-P1.

Instrument-validation gate (§7, re-worded pre-freeze — cite docs/stage-05-rq2p3-gate-clarification.md). The §7 items were re-worded before freeze because the original items 1–2 encoded the naive-funnel prior and were mechanically wrong under the ratified posterior (transparent deviation logged; no hypothesis changed — H1/H2/H3 stay two-sided). The re-worded gate validates the instrument, not a sign:

1. the frozen bridge-federated branch (not the pool) still shows the lead degeneracy — unique signatures → m_i = 1 → H_i ≈ 0, constant c_i = 1/C (a pool draws with replacement and cannot reproduce the injective fresh-bridge degeneracy, so the regression teeth live on the untouched branch);
2. the B = 1 boundary yields c = 1.0 (concentration tooth) and, under the ratified posterior, H at the high end (maximal mix) — the naive "low H" gloss is refuted by construction;
3. realized mean top-3 concentration is monotone (decreasing in B, increasing in alpha);
4. entropy calibration inherited (H = log₂N on equiprobable synthetic senders). A §7 scope note records that the gate must not pre-assert the H-vs-concentration sign — that sign is the two-sided confirmatory question; baking it in would be funnel-circular.

Pre-registered calibration finding (NOT a confirmatory result). The dry §7 pass — synthetic, offline, no confirmatory record read — already previews a mix: across the sweep Spearman ρ runs from ≈0 up to +0.838 (all cells ρ ≥ 0), the B = 1 boundary sits at high entropy (≈2.54 bits vs the fresh-bridge reference ≈0.0), and monotonicity + entropy calibration pass. This is surfaced openly as a pre-registered calibration preview, per the §7 scope note; it does not relax the two-sided pre-commitment, and the confirmatory sign remains withheld until after freeze. Honest disclosure the eventual write-up must carry: because the dry pass already previews the mix direction, the confirmatory battery quantifies a dose-response already visible at calibration; the two-sided pre-commitment stands and the lead RQ2-P1 headline is not re-litigated.

4. Methods B — RQ3 churn-resilient agent selector (frozen prereg)

Hypotheses, gates, DVs, and analysis are frozen in sor-consent-prereg.md (§3/§4/§6) and are restated, not redefined. The two open [APPROVAL] execution params were pinned blind to RQ3 outcomes (docs/rq3-companion-run-brief.md §2).

Design. Selector strategy {static, random, agent} at the RQ3 control cell (single-house / bridge-off) under a pinned churn schedule; static is the interleaved control, and control runs are bracketed before and after the {random, agent} treatments to catch grid drift. The cells are enumerated separately from the frozen 6-cell lead lattice so the lead battery stays bit-reproducible.

Pinned execution parameters (blind).

• Agent = qwen2.5:3b via local Ollama (agent_selector.OllamaAgentPolicy, temperature 0, per-run seed, (seed, state-hash) decision cache, deterministic heuristic fallback on query failure). Local / open-weight, $0; the Claude/frontier arm (ClaudeExploratoryPolicy) stays inert / EXPLORATORY / budget-gated and is not wired.
• Reproducibility caveat (accepted; must be stated in the paper). Ollama at temperature 0 is not bit-identical across machines (quantization / GPU logit drift). The agent arm is reproducible via the committed decision-log + (seed, state-hash) cache replay, not via independent model re-execution on other hardware — the same honesty class as the RQ1 timing caveat. The decision log + cache are committed as the reproducibility anchor.
• Churn = kill_prob_pct = 30, steps = 20, one deterministic schedule per run seeded from the same SHA256(S0 ‖ cell ‖ run) family; low-churn calibration baseline kill_prob_pct = 5.

Dependent variables (frozen). Throughput retention (throughput under churn / no-churn baseline); added latency = median end-to-end latency(agent) − median latency(best baseline arm), in ms — a live measurement only; and rebuild-classifier AUC over the rebuild-event time series (the per-run mean inter-rebuild-gap signal), per the [Barton2025] CLASI spirit.

Confirmatory gates (frozen, family-of-7).

Test	Frozen gate
RQ3-P1-perf	throughput-retention(agent) − max(static, random): 95% CI lower bound ≥ 10 pp
RQ3-P1-latency	added-latency(agent): 95% CI upper bound ≤ 100 ms
RQ3-P2	rebuild-classifier AUC: 95% CI upper bound ≤ 0.60
RQ3-P3	logical AND: CONFIRM iff P1 ∧ P2 (perf gain without a rebuild fingerprint); else H0

R = 30 runs/cell, C = 50 circuits/run, fixed stopping rule (inherited unchanged).

Analysis + multiplicity (Holm-7 supersedes note). The three RQ3 tests were always in the frozen size-7 family {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}. Once all seven p-values exist, the companion computes the exact Holm-7 step-down over the whole family; this is the authoritative final correction and supersedes the lead paper's deliberately conservative partial embedding (7/6/5/4 report-4) — both remain valid, the partial never under-corrects, and the lead paper's already-published RQ1-P1 / RQ2-P1 survive regardless (their reported raw p ≈ 0 — a lead-paper result, not a companion figure). Effect size + BCa 95% CI for every test; nulls reported honestly (a selector that does not beat baselines, or a rebuild pattern that is classifiable, is the finding). The QUIC / ssh3 transport arm stays EXPLORATORY and deferred (design decision D3), never in the Holm family.

Calibration gates (already green; NOT confirmatory results). Two boolean gates block the RQ3 confirmatory battery and have both passed on a dry, synthetic, offline pass:

• Churn-bites — at the pinned kp = 30 / steps = 20 the churn genuinely bites (non-zero drops/rebuilds across every RQ3 cell), so the retention and classifier tests are not degenerate.
• Rebuild-classifier calibration — churned (kp = 30) vs low-churn baseline (kp = 5) is separable on the per-run mean inter-rebuild-gap signal (calibration AUC ≈ 0.93), while baseline-vs-baseline is not (null AUC ≈ 0.52); plus an agent cache-replay reproducibility check and the inherited entropy calibration. These are calibration readings on labelled control signals, not fit to confirmatory cells; the frozen instrument (rebuild_interval_gaps, rebuild_classifier_auc) is unchanged.

---

5. Results (HELD-BLIND — no confirmatory number written)

• RQ2-P3′ (H1 / H2 / H3) — RESOLVED: MIX. From the sealed confirmatory record (9 cells × R=30 × C=50, offline + deterministic, S0 = 20260719):
  • H1 (within-cell association). Pooled Spearman ρ = +0.6244, BCa 95% CI [+0.5941, +0.6545] (run-level cluster bootstrap, 10,000 resamples). CI excludes 0 on the positive side → mix.
  • H2 (dose-response). OLS slope of per-run mean-H on per-run mean concentration β = +0.7052, BCa 95% CI [+0.6195, +0.7903] over n = 270 run-level points. CI positive → mix.
  • H3 (joint). H1 and H2 agree in sign (both +) and both exclude 0 → mechanism RESOLVED = MIX.
  • Holm (own family {H1-pooled, H2-slope}, size 2). Both tests reject at α = 0.05 after Holm correction. (p carried only for Holm ordering; the effect + CI above are the reported quantities — never a bare p.)
  • Across the sweep, as pool size B rises concentration falls and entropy H falls together (e.g. B=2/α=0: conc ≈ 1.00, H ≈ 2.54; B=8/α=0: conc ≈ 0.51, H ≈ 2.19) — concentration and H move together, positively: higher concentration ⇒ higher anonymity (mix), not lower (funnel).
• RQ3-P1-perf / RQ3-P1-latency / RQ3-P2 / RQ3-P3. HELD — pending operator-GO on the live isolated grid. Throughput-retention margin, added-latency (live-only), and rebuild-classifier AUC over confirmatory cells are not computed; the only figures on record are the two green calibration gates (churn-bites; classifier AUC ≈0.93 sep / ≈0.52 null), labelled calibration.
• Holm-7 (companion, authoritative). HELD until all seven confirmatory p-values exist.

6. Discussion (HELD-BLIND — placeholders)

• Does a shared bridge funnel or mix? — It mixes. Both pre-registered two-sided tests resolve positive (H1 ρ = +0.6244 CI [+0.5941, +0.6545]; H2 β = +0.7052 CI [+0.6195, +0.7903]; H3 RESOLVED = mix; Holm both reject). Plainly: concentrating circuits through a finite shared willing-bridge pool RAISES the per-circuit anonymity set — circuits that share a bridge share an exit signature, so the observation-consistent set grows and entropy rises. This refutes the naive funnel intuition (that concentration would shrink the set) and, per the mechanism developed in docs/note-unique-bridge-artifact.md, qualifies the lead RQ2-P1 "shrink" as a unique-bridge (fresh-bridge-per-circuit) instrument artifact: the lead topology assigned a fresh bridge per circuit seed, making every exit signature unique, every anonymity set size 1, and H≈0 by injective construction rather than by funnelling. Under a finite shared pool the injectivity is removed and the true sign of the concentration→anonymity relationship is revealed to be a mix. This is an honest qualification/correction of the lead reading via the frozen mechanism prereg (SHA-256 8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b), not an overwrite: the lead RQ2-P1 result and its frozen prereg stand as published and are not re-litigated.
  • Mandatory disclosure (pre-registration honesty). The §7 calibration dry-pass — synthetic, offline, no confirmatory record read — already previewed this direction (Spearman ρ running 0 → +0.838 across the sweep, B=1 boundary at high entropy). The confirmatory battery therefore quantifies a dose-response that was already visible at calibration; the pre-committed hypotheses were nonetheless two-sided and that pre-commitment is unchanged. We surface the calibration preview openly so no reader mistakes the confirmatory sign for a post-hoc choice.
• Does the agent selector help without leaking? HELD. RQ3-P3 confirms only if the agent both clears the +10 pp retention / ≤100 ms latency bar and leaves a non-classifiable rebuild pattern (AUC CI upper ≤ 0.60); either failure is an honest H0 (perf cancelled by teardown overhead, or the rebuild timing is a usable fingerprint).
• Scope & limitations. HELD — will inherit the lead paper's lab-grid external-validity scope, add the RQ2-P3 as-instrumented concentration/mix caveat, and carry the RQ3 agent-reproducibility caveat (cache-replay, not cross-hardware re-execution) with equal prominence.

---

References

Inherit the lead paper's reference list (docs/stage-07-paper-draft.md §References) unchanged. The companion cites only references already grounded in the frozen sources: Chaum1981, Serjantov2002, Diaz2002, Egners2012, NasrBH18, OhYMH22, SirinamIJW18, RahmanSMGW20, Danezis2003 are in the lead paper's list; Barton2025 (CLASI rebuild/timing-classifier spirit) is grounded in the frozen lead prereg's RQ3 dependent-variable definition (sor-consent-prereg.md §3) and carries into the companion's assembled list. No reference is added that cannot be grounded from the frozen prereg or stage-01 literature.