The sensitivity analysis puts the design's resolution at about two exact-match points, which is where the observed effects are, so the obvious lever is a less noisy outcome. Exact match is binary and maximally variable; the run already records a normalised exact match and an edit similarity. Read over the three seeds under the crossed interval, on the same clusters:
Superseded. These sizes and bounds belong to the retired organization-against-organization gate on corpus v1; the current bounds are the fixed-K simulation's (2026-09-30), and its test size is re-projected over twelve months (audit, 2026-09-30).
Extends the entry above to the deployment question: not "was this named client in the round" with the other participants drawn from other organizations, but "did this organization take part" with the round drawn from every client. The organization's clients are split once into the attacker's reference and the participants it may contribute, so no round is scored against itself.
sphragis/measure/aggregate.py, scripts/aggregate_attack.py,
datasets/results/aggregate-attack.json. The per-client attack assumes the server sees each
update; secure aggregation shows it only the round's mean, which is what a federated deployment
would claim as its protection. Both detectors below are what an honest-but-curious server could
run with reference updates of its own, computed exactly from the Gram matrix adapter_geometry
already recorded, without touching the weights.
datasets/results/determinism-sym-0-gh-a-081.json, -gh-a-003.json. The base model over the same
150 prompts, four passes a job, two jobs on different nodes.
datasets/results/rq1-qtfull-seeds.json, seed-effect-qtfull.json. The windowed RQ1 run repeated
at seeds 2 and 3, same corpora, split and held-out examples, read by crossed_reread.
The client-level permutation treated clients as exchangeable, and clients share their project. The
honest test leaves each client's own project out of every class mean, so an organization has to be
recognised from its other projects, and permutes organization labels across projects, not
clients (attribution.group_permutation_p, exact over all distinct relabelings when few enough).
On the 34 clients of job 148513:
Commits 38936f3 to 405462b reviewed, every finding reproduced and fixed. The one that touches a
result: clients.partition could get stuck behind a client no remaining change completed, losing
every client after it, so client counts depended on the shuffle. The executed run (148513) was
affected in count only, its clients disjoint and exactly sized: starlingx/docs gave 4 where 5 are
possible. The packer is now first-fit decreasing over open clients, which reaches the maximum for
every corpus but starlingx/docs (5 of 6, where very large changes cannot pack exactly). The next
client run, with AOSP added, uses it. The others: a skipped micro-batch now stops a client as a
skipped step does, since it leaves the client short; conjunctive_power refuses a seed effect with
one seed instead of recording one it did not simulate; seed_effect no longer crashes on a pair
with no noise; adapter geometry skips the zero-norm initial state.
Narrowed later on 2026-09-18. "What limits power" held for the null at this size only; see "RQ1 at three seeds, and the seed effect in the setting that counts" below.
To separate an organization from its codebase family, RQ2 needs several projects per organization
in one shared language on both sides. Qt's C++ libraries have that; a second organization with
several C++ projects on public Gerrit supplies the other side. AOSP (android-review.googlesource.com)
does: seven C++-dominant projects (art, system/core, bionic, frameworks/native, frameworks/av,
external/perfetto, system/netd), about 40% of merged changes carrying inline comments in a sample
of thirty. It answers residential addresses and refuses datacenter ranges, so it is fetched from a
workstation, and fetch --project bounds it and records the restricted query in the snapshot.
Corrects the interpretation of the entry above, whose tables stand. The organization accuracy of 0.912 is a statement about class means, and class means inherit the class's composition. Per project, measured from the same cosines:
Corrected the same day, and again with a third organization. The interpretation below overreaches: per project there is no organization pull beyond the codebase family, and once a content type is carried by two organizations at several projects each, organization is not attributable at all (0.416 against a 0.506 majority). See "What the client updates identify is the codebase family" and "The organization is not in the update" below. The numbers stand; the organizational reading does not.
datasets/results/projects-qt-creator_qt-creator-qt_qtbase-n788.json. qt-creator vs qtbase rerun at
788 training examples per side (TRAIN_SIZE=788, a nested subsample of the 1,517), the size the two
qtdeclarative pairs trained at. Same held-out changes, one seed.
datasets/results/adapter-geometry-s1.json, scripts/adapter_geometry.py. RQ2's per-client
question in its simplest form: is a LoRA update's direction in weight space closer to updates from
its own organization? The cosine between two updates dW = (alpha / r) B A, for every pair of the 35
saved adapters and all 196 adapted modules, computed through r x r traces without forming dW. Run
from a worktree pinned at e23b905 so the queued jobs' checkout was untouched; CPU only, three
minutes. Weight-space provenance is established for the training objective (Paul,
arXiv:2604.08844, AUC 1.00 from spectral features), which names "organic drift from distributional
shift", the same objective on different data, as untested. This is that case.
sphragis/measure/stats.py crossed_bootstrap, sphragis/experiment/walk.py crossed_gate.
Seeds and changes are crossed, every seed scoring every change, so the interval is Owen's
pigeonhole bootstrap (Ann. Appl. Stat., 2007): one draw of seeds and one of changes, independent
and with replacement, the statistic over their intersection. A nested bootstrap (changes, then
runs within each) would treat a seed's shift as independent per change and average it away; an
industry comparison of that nested form found it very conservative, 98 to 99% coverage against
95 (Indeed Engineering, July 2026). Built beside the registered gate, not registered.