The engine, reviewed as an adversary.

The cryptographic spine is sound. One in-circuit hole let a prover forge a passing credential — it is now closed.

The independent verifier is genuinely zero-trust in real mode: the STARK seal is checked against a compiled-in image ID, the journal is bound to the receipt, the dataset Merkle root is re-derived by the verifier, and the risk-gate policy is pinned. No-lookahead holds across every engine path, and the codebase's honesty discipline is unusually strong — the hard line against "audited / secure / production-ready" claims is held everywhere, and the real STARK path is implemented, not stubbed.

Six auditor roles, each a distinct adversarial lens.

The engine was reviewed under six auditor roles across the engagement (sixteen agent instances at peak), each scoped to one failure class and instructed to read the current code and cite file:line, not to trust prior documentation. Findings were triaged by severity and reproduced against the running binaries before remediation.

What the review surfaced.

24 findings across five severity tiers. The criticals are genuine forge-a-credential vectors inside the circuit; the highs are correctness, confidentiality, and build defects. Every finding below carries its status after same-day remediation.

The prover picked the annualization factor. That forged the gate.

Sharpe scales with √(periods per year); CAGR scales with its exponent. Both are monotonic in periods_per_year. The bar interval was bound to the data — lying about it fails validation — but the annualization basis was never tied to that interval. A prover could take honest daily bars and simply declare six times as many periods per year.

// mizan-core/src/lib.rs — folded into data_valid on every price path
pub fn ppy_consistent(interval_secs: i64, periods_per_year: u32) -> bool {
    if interval_secs <= 0 { return true; } // irregular data → declared basis
    (periods_per_year as i64).saturating_mul(interval_secs) <= SECONDS_PER_YEAR
}
// over-count → DataInvalid → gate FAIL. Honest under-count (equity 252) allowed.

Every finding, accounted for.

Sixteen remediations shipped the same day, each verified by the rebuilt test suite and an end-to-end dev-mode prove/verify smoke test. A follow-up pass on 2026-07-03 closed the data-provenance gap (interim), re-minted the real proof, and re-verified the critical fix. Open items carry an explicit, honest rationale rather than a silent close.

We adversarially audited our own just-shipped in-circuit ML engine. It caught a live overclaim on this very site — corrected the same day.

On 2026-07-18, hours after shipping guest v5 — the in-circuit black-box gate and zkML proven-inference credential families, plus a re-minted flagship — the engine was put through a second internal adversarial review: five AI auditor agents in parallel (ZK circuit soundness, cryptographic binding, quant honesty of the flagship, deployed-claims integrity, and a dedicated forge-a-credential red-team), each finding independently re-verified before action. The single most important result is the one an honesty-branded company most wants to find in its own work before anyone else does.

Corrected on this site, same day

The anti-hindsight anchor — shipped

We reviewed a statistic before it shipped, and again after — catching a way to game it, then a way to overstate it.

The Deflated Sharpe Ratio (Bailey & López de Prado, 2014) corrects a Sharpe for how many strategies you tried before picking the winner — but only if the trial count N is honest, and nobody reports it honestly. MIZAN built an in-circuit DSR that commits N in a Merkle trial ledger. It was audited twice: on 2026-07-18 before it was wired into any credential (D1–D3), and again on 2026-07-20 after it shipped as a public credential (D4–D6). Both audits found real issues; all are fixed. The credential is live and independently verifiable — N=10 committed trials, every trial's Sharpe re-derived in-circuit, and the deflated Sharpe of 0.6779 at /verify/.

Studio surface — 2026-07-21 five-front audit

A parallel five-auditor sweep of the self-serve studio — claims, methodology, application/ZK security, UX, and cross-property consistency. The self-serve DSR / registry surface, shipped fast, went out under-secured; the live-money and honesty items were fixed the same day.

Reproducible, not asserted.

Every claim above is backed by a rebuilt binary and a run. The build is green across all crates, the full test suite passes, and the critical fix was confirmed end-to-end against the live host and verifier. Transcripts below are recorded as-run (July 2026, era v10); the current canonical bundle is 225 KB and verifies offline in ~81 ms.

$ cargo test -p mizan-core
test result: ok. 50 passed; 0 failed; 0 ignored     # was 0 compiling

$ cargo build --release -p host -p verifier
    Finished `release` profile [optimized] target(s)

$ RISC0_DEV_MODE=1 host --prove c1_cheat.json   # daily bars, ppy=2190
  GATE VERDICT : FAIL ✗
  DIAG: net 553.2% · CAGR 584.8% · … → fails: [DataInvalid]   # C1 blocked

$ verifier credential.bundle  (dev receipt)
  ⚠️ CHECKS PASS but the receipt is NOT a real STARK — exit 3   # M3

$ host --prove btc_directional.json --minimal   # H5 minimize path
  🔒 MINIMIZED: only PASS/FAIL committed — strategy unrecoverable

$ host --credential            # real proving, RISC0_DEV_MODE unset (~12 min)
  Compressed proof: 3547 KB → 220 KB (succinct), verify ✓ 13ms

$ verifier credential_REAL.bundle data/prices.csv
  [✓] guest image id matches the program we trust
  [✓] zk receipt verifies (proof is real)
  [✓] committed journal matches credential (no swap)
  [✓] data root recomputed from canonical CSV matches
  [✓] data root pinned to canonical allowlist: prices.csv   # U5 — new
  [✓] gate policy is the canonical MIZAN policy … (16/16 checks)
  ✅ INDEPENDENTLY VERIFIED — exit 0

$ verifier <bundle> substituted.csv              # fabricated history
  [✗] data root NOT in canonical allowlist — substituted/unknown dataset

$ curl /api/verify-real
  real_verified: true · elapsed_ms: 51.2 · proof_kb: 219

What the engine guarantees — and what it does not.

Trust in a verification product is bought with disclosed limits, not hidden ones. After remediation the cryptographic guarantees hold; the remaining gaps are named, tracked, and gated behind an external audit.

What is still open, with dates.

A security page that only lists closes is a marketing page. These are the items open as of this publication, each with the date it was raised and where it is tracked.

If MIZAN disappeared tomorrow, every credential would still verify.

Security includes the question no vendor likes: what depends on us staying in business? The honest answer, stated plainly.

Companion: the Quant Integrity Review — the flagship number itself, put on trial against the retraction ledger. Not an offer of any security or investment product; metrics referenced are historical, after-cost figures. "MIZAN" is a verification and technology provider, not a licensed investment firm.