Statistical Characterization of Unattributed Append Events

An append is attributed if the substrate can name the terminal that submitted it. All 96 terminals authenticate in hardware and are physically inventoried. An append is unattributed if it is accepted, verifies, and carries no such attribution. Internally these are termed cold attestations; the term is not used in this note, for the reasons given in NC-GL-0001.

Verification here means the procedure applied to every append without distinction: a record hashed under FIPS 202 [1], a composite signature valid under FIPS 204 [2], and inclusion demonstrable against a published root by the construction of RFC 6962 [3]. Position in the sequence is fixed at write and is not revisable afterwards [4]; the ordering guarantee this rests on, and the one case in which it does not extend, are stated at NC-TN-0147 [5].

The window opens before NC-INC-0012 was registered. The earliest appends in it were classified retrospectively: the pattern was characterized first, the log was then re-examined, and events already written were reclassified as unattributed at that point. Registration therefore postdates the start of the window by some months. That interval is a fact about when the phenomenon was noticed and not about when it began.

3.1 Arrival process. Inter-arrival times were binned and tested against a homogeneous Poisson model over successive 90-day windows; the window is divided into 45 complete windows and a 29-day remainder, which is not tested. The fit is not rejected in 42 of the 45 (χ², 12 d.f., p > 0.4). The three exceptions are not adjacent and no correction for multiple comparison was applied, so we do not treat the count as evidence of anything beyond the fit being unrejected in the large majority of windows. Across windows the rate parameter increases monotonically. The process is therefore well described as Poisson with a slowly rising rate, and is not well described as constant. The test is a distributional one on inter-arrival times and has limited power against rate drift within a single window; §6 records what follows from that.

3.2 Independence. No autocorrelation was found at any lag tested (1 s to 30 d). A fault in timing, power, storage, or firmware produces correlated events: bursts, periodicity, or clustering around maintenance windows. We tested for all four and found none. Whatever generates these appends does not generate them in a manner consistent with a common cause.

3.3 Linkage. Identity commitments are uniform to an outside observer and comparing their distributions carries no information; we do not report such a comparison. Commitments are, however, linkable under NeuroCrypt's own enrollment parameters, which is the property Program Witness measures as declining variance (NC-PR-0003 §3.2). Applying that linkage procedure to the unattributed set does not leave it unstructured. It partitions it into apparent distinct sources, and the partition is stable under re-run and under held-out subsampling. The estimated number of apparent sources active in the trailing 90 days is ████.

3.4 Depth signature. Witnessed state hashes encode Ring conditions, which vary measurably with depth. Unattributed appends carry depth signatures distributed across the full 0-1,340 m range, with a mode at 1,290 m. No terminal is sited at 1,290 m.

Contributed by Program Cold Mirror. A subset of unattributed appends was submitted for reconstruction under NC-PR-0001. Outcomes are reported here in aggregate only.

6.1 Absence of evidence for a common cause is not evidence that no common cause exists. Our instruments are the substrate's own; a fault in the substrate could in principle be invisible to tests run on the substrate. We regard this as the most serious limitation of the work and have no means of addressing it from inside NeuroCrypt.

6.2 The terminal inventory is assumed complete. It is maintained by Operations and audited annually. We did not independently verify it for this note. If an unlisted terminal exists, §3.4 has a mundane explanation and most of this note is unnecessary.

6.3 The rising rate is fitted, not explained. Extrapolation beyond the observation window is not supported by this note and is addressed in NC-TN-0204, which is withheld pending review.

6.4 The §3.1 test constrains the shape of the inter-arrival distribution within a window; it does not constrain drift in the rate across that window, against which it has little power. Since §3.1 also reports the rate rising monotonically between windows, drift within them should be assumed rather than treated as excluded. A counts-based test on sub-intervals would decide it. We did not run one, and the result of this note does not depend on the outcome.

6.5 We have not established that the unattributed appends have a source in the ordinary sense of the word. We have established that they behave, under every measurement we can make, as though they do.