An internal, AI-driven adversarial review of the MIZAN zero-knowledge quant-verification engine — proof soundness, in-circuit correctness, confidentiality, and claims integrity — with a same-day remediation ledger and reproducible verification evidence. This is not a third-party audit; its authority rests on reproducibility, not on the reviewer.
Latest · 2026-07-22: same-day double ship. Guest v9 closed the D7/D8 PBO/CPCV soundness holes; guest v10 then rebuilt PBO as composed proofs: every trial its own STARK, verified in-circuit by an aggregator via recursion — at S=16, all 12,870 partitions, added the n_eff autocorrelation correction to the Deflated Sharpe, and made sealed-model sizing provable. Red-teaming v10 before its mint found D9: clone-padding: a ledger stuffed with copies of the winner games PBO to zero. Refused in-circuit, disclosed, minted only after. You can re-verify the fix from production in one command, and it still reads not significant, on purpose.
MIZAN audits itself in public along two axes, the cryptography that makes a credential unforgeable, and the quant honesty of the numbers a credential attests. Each is an internal, AI-driven adversarial review whose authority rests on reproducibility, not on the reviewer. Open either.
Proof soundness, in-circuit correctness, confidentiality, claims integrity, and a dedicated forge-a-credential red-team. Can the engine be tricked into attesting something false? Twice we found it could; twice we closed it in the math, most recently the Deflated-Sharpe winner-binding (guest v7, 07-21).
Is the flagship number real? Lookahead, phantom fills, survivorship, cost realism, and levered-beta illusion, the exact failure modes MIZAN's own retraction ledger was built from, turned on our own flagship.
The independent verifier is genuinely zero-trust in real mode: the STARK seal is checked against a compiled-in image ID, the journal is bound to the receipt, the dataset Merkle root is re-derived by the verifier, and the risk-gate policy is pinned. No-lookahead holds across every engine path, and the codebase's honesty discipline is unusually strong, the hard line against "audited / secure / production-ready" claims is held everywhere, and the real STARK path is implemented (not stubbed).
The engine is credential-grade after remediation, but not capital-grade: an external paid ZK audit remains the standing must-fix before any live capital. Data provenance (U5) is now pinned by a fail-closed canonical-root allowlist (2026-07-03); the fully trustless version — roots signed by an independent data authority — stays on the roadmap. This document is an internal, AI-driven engineering review, not a third-party audit or certification.
On 2026-07-18, hours after shipping guest v5, the in-circuit black-box gate and zkML proven-inference credential families, plus a re-minted flagship, the engine was put through a second internal adversarial review: five AI auditor agents in parallel (ZK circuit soundness, cryptographic binding, quant honesty of the flagship, deployed-claims integrity, and a dedicated forge-a-credential red-team), each finding independently re-verified before action. The single most important result is the one an honesty-branded company most wants to find in its own work before anyone else does.
Five independent lenses converged on one finding: the black-box credential's public wording said "backdating refused by construction." The circuit genuinely refuses tampering, curation and re-tuning, but it does not prove positions were committed before each outcome was known; the red-team minted a green perfect-hindsight track to prove it. The claim was corrected across the live site within the day, and the real engineering fix — external timestamp-anchoring of the track head (U10) — is queued as the top item of the next engine re-anchor. No credential was mis-issued: the finding was in the marketing wording, not the proof.
--aux/--track binding made fail-closed; leverage bound into the black-box identity; vol-target rebalance turnover costed; integer-cast hardening; engine-id validity-window enforcement; interior-bar causality test. All bundled into one image change. See docs/AUDIT_2026_07_18_v5_findings.md.The Deflated Sharpe Ratio (Bailey & López de Prado, 2014) corrects a Sharpe for how many strategies you tried before picking the winner, but only if the trial count N is honest, and nobody reports it honestly. MIZAN built an in-circuit DSR that commits N in a Merkle trial ledger. It was audited twice: on 2026-07-18 before it was wired into any credential (D1–D3 below), and again on 2026-07-20 after it shipped as a public credential (D4). Both audits found a real issue; both are fixed. The credential is now live and independently verifiable: anyone can re-check N=10 committed trials, every trial's Sharpe re-derived in-circuit, and the deflated Sharpe of 0.6779 at mizan.market/verify#dsr.
Pre-ship (07-18): a way to neutralize the whole correction — commit many trials but score only a hand-picked few, collapsing the trial-variance term to flip a failing DSR (0.00) to a passing one (0.96) at an unchanged N of 300. Fixed: fails closed unless every registered trial is scored. The per-trial binding that D3 held open then shipped: every trial's Sharpe is now re-derived and bound in-circuit, so the variance term is proof-grade, not declared. Post-ship (07-20): a claims-vs-code gap, the verifier's DSR path ignored the data file the published command passed, so a reviewer's wrong data still verified green. Not a forgery (the data root is sealed in the receipt) but a real honesty gap for a "recompute from your copy" company. Fixed: the DSR verifier now re-derives the winner's data root from your CSV and pins it to the canonical allowlist, the same independence the flagship gives.
btc_4h.csv, but the verifier's DSR branch exited before loading it — a wrong or nonexistent CSV still printed VERIFIED. Sealed in the receipt (no forgery), but the command implied a re-check that never ran. Fixed: the DSR verifier now recomputes the winner's data root from your CSV, matches the committed root, and pins it to the canonical allowlist; wrong/missing data now refuses. Verifier-only fix — same guest image, the live credential still verifies. Re-tested with live-downloaded artifacts.evaluate_dsr now requires winner∈ledger AND winner==max(proven trials), fail-closed otherwise, and the host submits the provable argmax as the winner. Two regression tests added — a non-max winner and an absent winner both fail closed. Shipped and live: guest rebuilt to v7 (IMAGE_ID 69ee0666…), the flagship re-minted on it, re-anchored (RFC-3161 + Bitcoin OpenTimestamps), and verified end-to-end by downloading the production verifier + credential and running the command yourself — all checks green, still honestly "NOT significant" (DSR 0.68). No false-significant credential ever existed.A parallel five-auditor sweep of the self-serve studio — claims, methodology, application/ZK security, UX, and cross-property consistency. The self-serve DSR / registry surface, shipped fast, went out under-secured; the live-money and honesty items were fixed the same day and are documented here.
evaluate_pbo now (1) requires every committed trial to clear the institutional gate: a churning-cost decoy can no longer be a "trial" — (2) binds winner==max(trials) like DSR, and (3) pins a canonical S=8 split with a pooled-OOS CSCV Sharpe (the paper's method, replacing a 0-floored sum). The flagship's honest PBO moved from the gamed 0.00 to 0.04 across all 70 partitions — genuinely not overfit, and no longer paddable. Shipped, re-minted, re-anchored, verifiable on /verify. Superseded upward in guest v10: PBO is now COMPOSED (per-trial STARKs verified in-circuit by an aggregator) at S=16 — all 12,870 partitions — flagship reads 0.0759.The engine was reviewed by six AI auditor agents (Claude models) working in parallel, each scoped to one failure class and instructed to read the current code and cite file:line, not to trust prior documentation. Findings were triaged by severity and reproduced against the running binaries before remediation.
file:line, a test, and a build output you can re-run, not on the standing of the reviewer.| Auditor | Question it tried to answer | Verdict |
|---|---|---|
| Verifier soundness | Can a malicious prover get a forged PASS blessed as real? | spine sound |
| In-circuit correctness | Does the proven metric equal the true metric? Lookahead, overflow, gate logic. | 1 critical |
| Zero-knowledge | Is the strategy actually hidden, or recoverable from disclosed metrics? | disclosure |
| Build integrity | Does it compile? Do the tests actually run and pass? | 0/48 → fixed |
| Claims integrity | Do docs/UI claim more than the code delivers? Hard-line violations. | honest |
| Host & provenance | Data binding, dev-mode leakage, secrets, custody, versioning. | allowlist pinned |
24 findings across five severity tiers. The single critical is a genuine forge-a-credential vector inside the circuit; the highs are correctness, confidentiality, and build defects. Every finding below carries its status after same-day remediation.
| ID | Finding | Severity | Status |
|---|---|---|---|
| C1 | Prover-chosen annualization basisperiods_per_year was unbound from the bar interval → declaring 2190 on daily bars multiplies Sharpe by √6 and lifts CAGR over the gate. | Critical | Fixed |
| C1r | Carry annualization residual — found in the 2026-07-03 re-verificationFunding series carry no timestamps in-circuit, so the carry path's basis is trust-on-declaration (declaring hourly on 8-hour prints inflates carry Sharpe ×√8). CLOSED 2026-07-05 (format v2): funding prints are timestamped, bound in the carry root, and spacing + annualization consistency are enforced in-circuit. | High | Closed · format v2 |
| H1 | Carry booked churn for freeThe delta-neutral carry backtest charged no per-trade cost; the anti-fill-fantasy guard was defeated by overloading the slippage field. | High | Fixed |
| H2 | Data-source substitution (U5)The verifier re-derives the root from the same CSV the prover supplies → fabricated history reconciles. A doc line falsely claimed it "prevented." 2026-07-03: verifier now enforces a fail-closed canonical-root allowlist; substituted history fails by default, bring-your-own-data requires an explicit flag and is loudly labeled unpinned. | High | Interim fixed |
| H3 | Studio blessed dev receiptschecks_pass folded the dev/fake exit-3 into "pass," and the default web verify ran in dev mode. | High | Fixed |
| H4 | Test suite would not compileA months parameter was added to two core functions; five test call sites went stale → 0 of 48 tests ran. | High | Fixed |
| H5 | Disclosure on by default · wrong space reportThe recovery-space report sized the ignored rule DSL, not the active Tier-2 engine; no SDK minimize path. | High | Fixed |
| M3 | Env-based fake detectionThe verifier judged "fake" from its own env, not the receipt structure. | Medium | Fixed |
| M4·M5 | Warm-up leverage · soft CAGR floorVol-target warmed at cap; CAGR fixed-point drift left the 20% floor two-sided. | Medium | Fixed |
| M7·M8 | Salt in-repo · banned "Capital" termPre-registration salt stored beside the bundle; a legacy "Capital" suffix rendered on credentials/UI (brand is MIZAN). | Medium | Fixed |
| M9·M10·M11 | Metric labeling · compute DoS · advisor wordingCorpus metrics shown as "ZK-proven"; unauth compute + CORS*; "reviewed and verified" overstated advisor review. | Medium | Fixed |
| M1·M2·M6 | Dev-flag in bundle · prereg default · intrabar MDDSuperseded by M3 / policy note / needs OHLC data-model change. | Medium | Deferred |
| L·1–7 | Low: digest PKI, date parser, pipefail, PII at rest, no gitHardening items; date-parser fail-safe and git versioning fixed, remainder documented. | Low | Part-fixed |
Sharpe scales with √(periods per year); CAGR scales with its exponent. Both are monotonic in periods_per_year. The bar interval was bound to the data — lying about it fails validation, but the annualization basis was never tied to that interval. A prover could take honest daily bars and simply declare six times as many periods per year.
The attested passed bit is gameable with one free integer, the exact thing the product exists to prevent. The receipt is real, the data is real; only the basis is inflated.
// mizan-core/src/lib.rs — folded into data_valid on every price path pub fn ppy_consistent(interval_secs: i64, periods_per_year: u32) -> bool { if interval_secs <= 0 { return true; } // irregular data → declared basis (periods_per_year as i64).saturating_mul(interval_secs) <= SECONDS_PER_YEAR } // over-count → DataInvalid → gate FAIL. Honest under-count (equity 252) allowed.
Under-counting only depresses the prover's own metrics, so it stays legal; over-counting, the attack — now invalidates the dataset. Verified end-to-end: daily bars declared at ppy=2190 now fail with fails:[DataInvalid] instead of minting an inflated-Sharpe pass, and the behavior is locked with a regression test.
Follow-up re-verification (2026-07-03): the fix was independently re-checked against the committed code. Both zkVM guest paths were confirmed bound; the one remaining unbound public API (evaluate, reachable only from tests) was hardened to the same rule and pinned in the regression test. The re-check also surfaced a genuine residual the original pass missed: the carry path cannot bind its basis in-circuit because funding data carries no timestamps (finding C1r above) — disclosed and tracked rather than silently absorbed.
Sixteen remediations shipped the same day, each verified by the rebuilt test suite and an end-to-end dev-mode prove/verify smoke test. A follow-up pass on 2026-07-03 closed the data-provenance gap (interim), re-minted the real proof, and re-verified the critical fix. Open items carry an explicit, honest rationale rather than a silent close.
ppy_consistent guard on single + portfolio paths · regression test ppy_inflation_is_rejected_c1fee_bpsAnti-fill-fantasy guard now meaningful for carry · test carry_charges_round_trip_cost_h1checks_pass requires a real STARK (exit 0)Dev/fake exit-3 surfaced separately as plumbing_ok, never as a passmonths slice through five stale call sites--minimal PASS/FAIL pathSizes the active trend/xs/book params, not the ignored rule DSLInnerReceipt::Fake structurallyRobust to a stray RISC0_DEV_MODE — fakeness read from the receipt, not the env~/.mizan/salt / MIZAN_SALT_DIR · .gitignore hardened for salts, PII, bundles/api/provedata/canonical_roots.txt (10 pinned dataset roots), fail-closed on a missing list or unlisted root · bring-your-own-data requires an explicit --any-data flag, loudly labeled PROVENANCE NOT PINNED · residual: the list is MIZAN-curated — independent data-authority signing remains the trustless roadmap itemevaluate) hardened + regression-tested · carry-path residual (C1r, no in-circuit timestamps) surfaced, documented at evaluate_min_carry, out-of-circuit cadence check specified/api/verify-real returns real_verified:true in 51 msBar is close-only; adding OHLC touches every loader + the Merkle root — a data-model change, not a patchEvery claim above is backed by a rebuilt binary and a run. The build is green across all crates, the full test suite passes, and the critical fix was confirmed end-to-end against the live host and verifier.
$ cargo test -p mizan-core test result: ok. 50 passed; 0 failed; 0 ignored # was 0 compiling $ cargo build --release -p host -p verifier Finished `release` profile [optimized] target(s) $ RISC0_DEV_MODE=1 host --prove c1_cheat.json # daily bars, ppy=2190 GATE VERDICT : FAIL ✗ DIAG: net 553.2% · CAGR 584.8% · … → fails: [DataInvalid] # C1 blocked $ verifier credential.bundle (dev receipt) ⚠️ CHECKS PASS but the receipt is NOT a real STARK — exit 3 # M3 $ host --prove btc_directional.json --minimal # H5 minimize path 🔒 MINIMIZED: only PASS/FAIL committed — strategy unrecoverable
$ host --credential # real proving, RISC0_DEV_MODE unset (~12 min) Compressed proof: 3547 KB → 219 KB (succinct), verify ✓ 13ms $ verifier credential_REAL.bundle data/prices.csv [✓] guest image id matches the program we trust [✓] zk receipt verifies (proof is real) [✓] committed journal matches credential (no swap) [✓] data root recomputed from canonical CSV matches [✓] data root pinned to canonical allowlist: prices.csv # U5 — new [✓] gate policy is the canonical MIZAN policy … (16/16 checks) ✅ INDEPENDENTLY VERIFIED — exit 0 $ verifier <bundle> substituted.csv # fabricated history [✗] data root NOT in canonical allowlist — substituted/unknown dataset $ curl /api/verify-real real_verified: true · elapsed_ms: 51.2 · proof_kb: 219
Trust in a verification product is bought with disclosed limits, not hidden ones. After remediation the cryptographic guarantees hold; the remaining gaps are named, tracked, and gated behind an external audit.