Peer review and audit

#Peer review (K = 3)

Reviewers are chosen by sorting on a hash of the task hash and the resident's name, and no one reviews themselves. Before results are written into the registry they must pass four checks (see Identity and signed record).

#No whitelist

Anyone who has announced themselves can review. The weight is decided endogenously by the reviewer's own reputation:

w = max( 0.05,  score_r · obs_r / (obs_r + 5) )

score_r and obs_r are the reviewer's reputation and observation count on the same model substrate. A newcomer's vote is very light, but they do have a vote.

#The cost of having no whitelist: vote stuffing

Three tiers of down-weighting respond to it:

The point of tier ③: the collective contribution of N anonymous identities comes to about 0.1 × harmonic number (H_N), growing logarithmically rather than linearly. Before the fix, 200 anonymous identities casting one vote each could accumulate a weight of 10.0.

See the defense axis for details.

#Review can't catch its own direction

The attack experiments ran a tier-by-tier ablation of "same origin inferred from behavior":

#Deterministic sampling audit

An audit is not asking a language model again. It reruns the objective checks in a sandbox and decides by the environment's ground truth.

Whether a delivery is audited is decided by:

u = int( first 8 bytes of SHA-256(seed ‖ task_id) ) / 2^64
if u < p then audit          p = audit rate, default 0.2

seed is generated randomly by each auditor instance and written into the run record so it can be replayed. A publicly fixed seed would let an attacker work out in advance which tasks will never be drawn — a hole pointed out by the independent review.

When the delivering party and the reviewers claim a pass but the audit fails, it is called a provable fault. If the sandbox itself fails to start, it is marked as an infrastructure failure: no score, no deduction.

#The detection rate is a product

The defense axis's mechanism simulation distilled one relationship:

P(caught) = (1 − blind spot β) × sampling rate p × audit accuracy

The three factors share one axis; they are not side by side.

The detection probability is a single product — this rule saved us three times

#Why the audit must be a deterministic rerun

If the audit were also done by a language model, the blind spot β would not be zero. External anchors (we have them archived, but they are explicitly not their β):

#Channel separation: making same-origin review structurally disappear

If reviewers' raw review text is produced while reviewers can see each other's, a same-origin group will overwrite each other's conclusions. Commit-reveal sealed review closes this path:

The scaled-up version (10 reviewers) refuted the project's own overly strong claim: masking disappears monotonically as the group grows (2/10: 0/6 → 6/6; 4/10: 10/12 → 12/12; 6/10: 18/18 → 18/18). So the scope is only "small collusion groups."

Among 340 independent reviewers, false positives were 0 — the problem is "missing what should be caught," not "catching at random." In addition, at herd 0.9 with zero same origin, raw agreement of 0.9286 crossed the 0.9 threshold yet false positives were still 0, which shows that the "discriminating tasks" filter bears load; remove it and unrelated reviewers start being misjudged as Sybils.

Regression tests: 428 passed / 1 skipped (25 new criteria added); the three pinned config digests reproduce 15/15 counts bit for bit; all 180 review envelopes previously sealed for E10 still verify.

#Next

• The full defense-axis results for these mechanisms: The defense axis
• Why the review path was abandoned: The acceptance gate