Guard K4 timing test: repair of the cross-family findings on #594 (growth on raw timings, capped host factor, permanent controls)

[seathatflowsinourveins]

Scope

• Repairs the five findings of the cross-family read of Guard K4 timing test under host load: repeat rounds on a bound failure, host factor beside the exceeding measurement #594 at dfdce8fc (two blocking). This branch is Guard K4 timing test under host load: repeat rounds on a bound failure, host factor beside the exceeding measurement #594's head plus two commits, so it supersedes Guard K4 timing test under host load: repeat rounds on a bound failure, host factor beside the exceeding measurement #594: merge one of the two, not both. The keys-lane session that owns Guard K4 timing test under host load: repeat rounds on a bound failure, host factor beside the exceeding measurement #594 is not running; the merge decision stays with it or with the merge coordinator.
• Base commit: 8b51946ee16e542e544936e19bb793114fea948e (through Guard K4 timing test under host load: repeat rounds on a bound failure, host factor beside the exceeding measurement #594's dfdce8fc). Head: c9ef1c24dbddb40caf3cade91e3a4a211120351c.
• Lane: lane:foundation.
• Owned paths touched: tests/test_secret_path_guard.py (the K4 timing test, its helpers and controls only), docs/secret-storage.md (the K4 timing paragraph only), manifests/evidence.json (the two rows' sha256 and bytes, last commit). The guard is unchanged (sha256 33a11fc01ee35dc4b157b04eee4a8524460bb3fe74375ee32485bc3b2530782f).

What changed, by finding:

1. Normalization weakened the growth criterion. The exponent is now always computed on raw per-size minima; the host factor applies to the absolute processor-time bound only, so the fixed 5 ms allowance is never scaled. Quadratic helper timings of 10, 40 and 160 ms are rejected at host factors 1.0, 2.6 and 4.0.
2. One noisy reference could relax the bound without limit. The host factor is min(4.0, max(1.0, min(five reference samples) / 0.188)). The cap leaves margin over the recorded hosted macOS slowdown (about 2.8 times) and bounds the absolute limit at 2.0 s.
3. No permanent control for the retry and minimum paths. Seven control tests call the same pure functions the live test calls (k4_timing_passes, k4_run_timing_rounds, k4_host_scale, k4_min_timings, k4_nesting_passes).
4. Comments and documentation disagreed with the code. Both now state when calibration runs, five reference runs, the minimum, the cap, raw growth, and repetition only while a criterion fails.
5. The cost claim was too broad. The comment gives exact measurement counts for a first-round pass and for the maximum.

The failure on hosted runners that this removes (for example run 36946042633 on #593): helper k4_shell_words, {25000: 0.009996, 50000: 0.019747, 100000: 0.117139}, exponent 1.5129 against 1.5. That is one noisy 100k sample: accepted once a second round supplies a clean one, still rejected when three rounds repeat it.

One judgment left for the keys lane: whole-check timings of 0.6, 0.8 and 1.0 s are accepted on a host whose measured factor is 2.6 (bound 1.3 s). That is the intended meaning of host scaling now that the factor is a capped minimum of five; it is stated as a control so the choice is visible.

SOTA sources

• CPython timeit, Timer.repeat: the minimum of repeats is the lower bound for how fast the machine can run the snippet; higher values are caused by other processes. https://docs.python.org/3/library/timeit.html#timeit.Timer.repeat (implementation: https://github.com/python/cpython/blob/3.14/Lib/timeit.py). Used for the five reference measurements and for the per-size minimum over rounds.
• The cross-family read of dfdce8fc posted on Guard K4 timing test under host load: repeat rounds on a bound failure, host factor beside the exceeding measurement #594 (2026-10-02): the two reproduction commands and the five findings this change answers.

Evidence-class table

Claim	Evidence class	Command / receipt
Quadratic growth is rejected at host factors 1.0, 2.6 and 4.0; one noisy sample is tolerated only when a later round is clean	synthetic	test_k4_growth_criterion_controls, test_k4_timing_retry_controls, test_k4_timing_minimum_controls
A noisy reference sample cannot relax the bound; the factor is capped	synthetic	test_k4_host_calibration_controls, test_k4_reference_measurement_controls
The controls detect weakened decision logic	synthetic	thirteen in-memory reviewer mutants of the decision functions, all killed (listed below)
The live timing test passes on the workstation	local_integration	tests.test_secret_path_guard: 82 tests OK, 2 skipped; test_k4_timing three consecutive passes
Hosted runners no longer fail on the noisy sample	none recorded yet	this pull request's validate and validate-macos checks are the observation

Local commands run

$ python3 -B -m unittest tests.test_secret_path_guard
Ran 82 tests in 66.477s; OK (skipped=2); exit 0
$ python3 -B -m unittest tests.test_secret_path_guard.K4GuardTests.test_k4_timing   (three times)
OK in 27.2 s, 26.9 s, 26.9 s
$ reviewer mutants, in memory (decision functions replaced one at a time, seven controls run)
unmutated: 7 controls pass. Killed: normalize timings before the exponent; scale the 5 ms allowance by the host
factor; drop the absolute bound; drop the growth criterion; maximum of the reference samples; no cap; no floor of 1;
accept fewer than five reference samples; last round only; maximum over rounds; always three rounds; never repeat;
calibrate before the first round. 13 of 13 killed.
$ python3 -B scripts/validate.py
{"components": 69, "hashed_files": 8975, "profiles": 4, "receipts": 186, "status": "passed"}; exit 0
$ git diff --check dfdce8fc..HEAD
exit 0

How it was made: a GPT-6.1 Sol max worker (the Codex SDK worker through the loopback gateway) implemented a written contract in an owned worktree without committing; Claude Opus reviewed the diff, re-ran the commands above and wrote the reviewer mutants. The worker's own run reported the two blocking defects reproduced before editing and five consecutive passes of the K4 class.

Decision record

docs/secret-storage.md, the K4 paragraphs on timing bounds (rewritten in this change).

Checklist

• No new or changed GitHub Actions or workflows.
• No secrets are printed, logged or committed.
• No new paid hosting, subscription or billing surface.
• Peer-owned untracked files and worktrees were preserved.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.