R3-3: independence across dies and operators -- the contract #7497

Part of epic #6655, Round 3 item R3-3. Builds on R3-1 (#7332: signed receipts, LEVEL_FRESH) and R3-2 slice 2 (#7452: the die's DNA inside the signed bytes, distinct_dies3).

Goal

Decide when a run's three placements count as independent evidence. Three seeds on one board catch place-and-route faults, but not a faulty die or a mislabelled bench, and they say nothing about a dishonest operator. The epic asks that a citable run at the higher level needs agreement across distinct dies. This issue writes that rule as a contract.

Approach

• Contract specs/verified/independence.t27, judged in order, with the first failing fact named:
  1. every receipt is LEVEL_FRESH (signed, answering the verifier's nonce);
  2. every receipt is DIE_NAMED;
  3. all three name the same seal;
  4. the three verdicts agree; a disagreement is reported, never averaged away;
  5. no die is claimed by two operators (same DNA under two roster entries: at least one claim is false, or the board changed hands);
  6. the receipts name 3 distinct dies.
• Levels: INDEP_NONE < INDEP_DIES (all six hold) < INDEP_OPERATORS (also 3 distinct operators from the verifier's own roster; a key outside the roster never counts).
• Tool half, a later slice: generated Rust in t27c and thin glue reading three receipts. Measured on the three Wukong boards after R3-2 slice 2: the die's DNA as a signed receipt field (v2 message) #7452 lands.

Honest ceiling

• The DNA is a name, not a secret (R3-2 slice 2: the die's DNA as a signed receipt field (v2 message) #7452). So INDEP_DIES under one key catches honest faults: a bad die, a swapped cable, a wrong board. It does not catch a signer who writes three DNAs it never read.
• INDEP_OPERATORS is exactly as strong as the verifier's roster. Distinct keys are not distinct people, and three colluding operators defeat it, as a colluding majority defeats any re-execution quorum.
• Our bench has one operator key, so the most it can reach is INDEP_DIES.

Competitors, 2026-10-07:

• Gonka and EigenAI get independence from re-execution by other hosts, weighted by stake or restaking.
• A TEE quote (Phala, NVIDIA CC) needs no quorum, but trusts one vendor root.
• zkML needs no quorum and pays 1000x or more.
• t27: placements of one sealed bitstream must agree bit-for-bit, not statistically, and the rule is a compiled .t27 contract that anyone can re-run.

Acceptance

• t27c test-report specs/verified/independence.t27: all tests pass and 0 are vacuous, run on the Railway lab.
• Mutation check with the score recorded; every non-equivalent mutant is killed.
• Seal saved.
• No hand-written foreign code.

Boundary

• Edits only specs/verified/independence.t27 and its seal.
• No reflashing and no eFUSE or BBRAM writes.
• No gate files.
• No device-rooted level is claimed.

User Scenarios

• Given three LEVEL_FRESH, DIE_NAMED receipts for the same seal, when all three name distinct dies and agree on the verdict, and no die appears under two operators, then the contract yields INDEP_DIES.
• Given three receipts that pass the first five checks but two share the same die DNA, when evaluated, then the contract yields INDEP_NONE and names the distinct-dies check as the first failing fact.
• Given three receipts that satisfy INDEP_DIES and the verifier's roster contains three distinct operator keys matching the receipts, when evaluated, then the contract yields INDEP_OPERATORS.

Requirements

• FR-001: The contract specs/verified/independence.t27 MUST define a function that consumes three receipts and returns one of INDEP_NONE, INDEP_DIES, INDEP_OPERATORS.
• FR-002: The contract MUST evaluate the six independence facts in the specified order and report the first failing fact by name.
• FR-003: The contract MUST require every receipt to be LEVEL_FRESH (signed, answering the verifier's nonce).
• FR-004: The contract MUST require every receipt to be DIE_NAMED (contain die DNA per R3-2 slice 2: the die's DNA as a signed receipt field (v2 message) #7452).
• FR-005: The contract MUST require all three receipts to name the same seal.
• FR-006: The contract MUST require the three verdicts to agree bit-for-bit; a disagreement MUST be reported, not averaged.
• FR-007: The contract MUST require that no die DNA appears under two different operator roster entries.
• FR-008: The contract MUST require the three receipts to name three distinct die DNAs for INDEP_DIES.
• FR-009: The contract MUST grant INDEP_OPERATORS only when INDEP_DIES holds and the three receipts carry three distinct operator keys that all exist in the verifier's roster; a key outside the roster MUST never count.
• FR-010: The contract MUST be compiled by t27c with no hand-written foreign code in the verified path.

Success Criteria

• t27c test-report specs/verified/independence.t27 exits 0 with all tests passing and 0 vacuous on the Railway lab.
• Mutation check on specs/verified/independence.t27 records a score and kills every non-equivalent mutant.
• Seal file for specs/verified/independence.t27 is saved and committed.
• No hand-written foreign code appears in the generated artifacts for this contract.