# RH-W-19: Reproducibility and Adversarial Certificate Auditing

## Abstract

Instead of adding an isolated Weil matrix point, this round places the unified certificate backend of RH-W-18 under a replayable attack model. The goal is not to prove that "software cannot contain errors," but rather to classify errors into three categories:

1. Strictly rejectable within the package;
2. Requiring mathematical semantic recomputation to reject;
3. Unexcludable by the same self-certifying package, necessitating the introduction of an external root of trust.

This round constructs 17 classes of erroneous certificates, of which 16 should be rejected, and 1 is deliberately marked as `EXPECTED_SURVIVAL`.

## Backend v0.2

New additions to the backend:

- SHA-256 allowlist;
- Rejection of unindexed Python/JSON safe files;
- command path confinement;
- record input digest;
- dependency DAG checking;
- status-token consistency;
- isolated temporary replay;
- Global `RH_CLAIM=False` firewall.

The verification chain is

$$
\text{Artifact identity}
\to\text{Manifest semantics}
\to\text{Dependency DAG}
\to\text{Native replay}
\to\text{Claim firewall}.
$$

## Main Empirical Results

### Floating-Point False Negatives

The 14th-order Hilbert matrix

$$
H_{ij}=\frac1{i+j+1}
$$

yields fourteen positive pivots via exact rational $LDL^T$; however, double precision `eigvalsh` returns a negative minimum eigenvalue in this environment. This is a purely numerical false negative, demonstrating that a finite-dimensional negative witness must not be declared based solely on the sign of a floating-point eigenvalue.

### Tail Term Omission

For

$$
\sum_{k=0}^{\infty}2^{-k}=2,
$$

the partial sum truncated at $k=9$ is less than $1.999$, but the complete sum is $2$. Verifying only the truncated sum would erroneously accept an upper bound; the geometric tail must be explicitly included.

### Inward Interval

The decimal singleton

$$
[0.3333333333333333,0.3333333333333333]
$$

does not contain the exact $1/3$. Print precision is not an outward rounding certificate.

## External Trust Boundary

If an attacker simultaneously modifies:

- the certificate;
- the verifier;
- the manifest;
- the artifact index;
- all hashes;

and makes the verifier print only the expected token, there is no root within the package uncontrolled by the attacker that can identify this. This is not a patchable minor bug in this backend, but a fundamental limitation of self-certifying systems.

Therefore, the public release requires at least one of the following:

- Publisher digital signature;
- Git commit/tag with an external timestamp;
- Reproducible builds;
- A second independent verifier;
- A release digest from a third-party mirror.

## Conclusion

RH-W-19 establishes a "certificate of certificate failure." It does not advance any truth claims regarding the RH; it only improves the identifiability of errors, tampering, and overclaiming in the research artifacts.

$$
\boxed{\text{RH\_CLAIM=False}}
$$