Verify · Zero trust required

Don't trust us.
Verify it yourself.

A MIZAN credential is not a PDF you take on faith. It's a cryptographic receipt anyone can independently re-check — without trusting MIZAN, the manager, or the data provider. Run the source-available verifier on a real credential below. Seventeen conditions checked on a single credential — including exposures and regimes when the credential discloses them. The strategy stays hidden.

▶ Prefer to watch first? The 5-minute demo — real output, zero setup →

§ 01The fastest way

In your browser — no install.

The live engine verifies a real STARK credential end-to-end, in front of you, in about 81 milliseconds. Watch all seventeen conditions clear while the strategy is never revealed.

A

Run it in the studio

Universal · nothing to install · the exact same verifier, client-side in your browser — no server involved. The honest demo behind everything on this site.

Open the live engine ↗

≈81 ms is the canonical verify figure. Individual measured runs on an Apple-silicon laptop, Aug 2026, ranged 24–50 ms depending on artifact (Apple bundle 24 ms · sample credential 38 ms · chained pair 50 ms · registry re-verify 25 ms). Your machine will differ; the asymmetry — milliseconds to verify, minutes-to-hours to mint — will not.

§ 02The full-reproducibility way

From the command line — trust nothing.

Download a real credential, the canonical data it was bound to, and the source-available verifier. Run one command on your own machine. This is the whole point of MIZAN: the proof is portable and the issuer is irrelevant.

$ chmod +x mizan-verifier-macos-arm64 $ ./mizan-verifier-macos-arm64 mizan_sample_credential.bundle btc_4h.csv
════════════════════════════════════════════════ MIZAN · INDEPENDENT VERIFIER (PASS/FAIL only · zero trust) ════════════════════════════════════════════════ [✓] guest image id matches the program we trust [✓] zk receipt verifies (proof is real) [✓] committed journal matches credential (no swap) [✓] data root recomputed from canonical CSV matches [✓] data root pinned to canonical allowlist: BTC 4h (OHLC) [✓] gate policy is the canonical MIZAN policy [✓] dataset was canonical in-proof [✓] credential format v4 (disclosing) [✓] annualization basis bound to the committed 12917-bar window (C1) [✓] GATE VERDICT is PASS (zk-attested) [✓] a strategy commitment is present [✓] credential digest intact (tamper-evident) [✓] exposure card internally consistent (bands · leverage rail · instruments) [✓] regime policy is the pinned canonical policy [✓] regime panel internally consistent (bar accounting · return rail) [✓] regime bar counts re-derive from the canonical CSV ──────────────────────────────────────────────── Issuer : MIZAN Gate policy : Sharpe≥1.20 · CAGR≥20% · MaxDD≤25% · no bar<-12% GATE VERDICT : PASS ✓ Metrics : Sharpe 1.63 · CAGR 26.6% · net 301.61% · MaxDD 20.76% Strategy : ***NEVER REVEALED*** ════════════════════════════════════════════════ ✅ INDEPENDENTLY VERIFIED — a hidden strategy cleared the MIZAN gate on bound real data. Zero trust in the issuer.

Tamper test: change a single byte of the bundle and re-run, the digest and receipt checks fail instantly. The proof cannot be forged or edited.  ·  Other platforms: the verifier is source-available Rust — Linux/Windows builds and full source on request for any allocator or reviewer; full public source release follows the independent audit.  ·  macOS may quarantine an unsigned binary — clear it with xattr -d com.apple.quarantine mizan-verifier-macos-arm64.

§ 03Chained tracks · famous refusals

The gate that refused Apple. REFUSED

Minted Aug 2026 · era v11 (image 3ac3b10b…) · re-issued Aug 8 at the corrected annualization basis (the original Aug 4 mints are superseded per the public erratum). We submitted the most famous trades in history to our own gate — Apple buy-and-hold 1997→2026 (+272,548% net, Sharpe 0.89) and SPY buy-and-hold (9.2% CAGR, 99% market beta, proven in-circuit). Both REFUSED, both published. The verifier prints the sealed verdict exactly as proven — GATE VERDICT : FAIL — and marks it as a published failure whose proof is valid: a refusal can never be dressed as a pass, and a verified failure is the Standard working. Full analysis: the survival table.

$ ./mizan-verifier-v11-macos-arm64 legend_aapl_buyhold_20260808.bundle aapl.csv $ ./mizan-verifier-v11-macos-arm64 legend_spy_buyhold_20260808.bundle spy.csv

Expected output: every integrity check passes, the metrics re-derive on your machine — and the verdict line reads GATE VERDICT : FAIL. That is the point.

BTC-TREND-4H — the first pre-registered live track.

Minted Aug 11, 2026 · era v11 · real STARK, H100. The strategy's commitment 93c385b1… was pre-registered and timestamp-anchored (RFC-3161 landed; Bitcoin OTS confirming) before any future bar existed. Every future re-proof of this track runs on data that did not exist at commitment — the "was it made in hindsight?" question is closed by construction, not by trust.

$ ./mizan-verifier-v11-macos-arm64 track_BTC_trend4h_20260811.bundle btc_4h_full_ext_20260811.csv

Expected output: every check green, and GATE VERDICT : PASS ✓ — Sharpe 1.40 full window · 0.88 out-of-sample · net +930% over 9.0 yrs · MaxDD 23.27% · 125 trades · after 7+3 bps costs · strategy never revealed. (The same strategy's Jul 28 credential remains on the registry: real and PASS, but minted before pre-registration was wired into the mint path, so it can never be chained. That contrast is what this standard exists to fix.)

The chain is growing — link 1 is live. Minted the same day, the moment the next 4h bar closed: the same committed strategy re-proven over 19,671 bars. The appended bar did not exist when the commitment was anchored — for every bar from here on, hindsight is structurally impossible.

$ ./mizan-verifier-v11-macos-arm64 track_BTC_trend4h_link1_20260811.bundle btc_4h_full_ext2_20260811.csv --chain track_BTC_trend4h_20260811.bundle
[✓] CHAINED: same committed spec · window strictly extends parent (Merkle prefix) · parent digest matches 🔗 track: parent 19670 bars → this credential 19671 bars (+1) · parent digest f009397aaafc2762… GATE VERDICT : PASS ✓ (extended window)

Each future extension re-proves the same commitment over a strictly longer window and is re-judged by the same locked gate — pass or fail, it lands on this page and on the registry wall. The next extension is publicly due ≤ 30 Nov 2026 — the live chain.

Try to make it lie.

We flipped one bit — a single 0 to a 1, byte 100,000 of the live-track credential — and published the tampered file next to the real one. Run both. The intact bundle returns seventeen green checks. The tampered one is caught by the STARK itself, and the verifier tells you exactly which condition died.

$ ./mizan-verifier-v11-macos-arm64 TAMPERED_one_bit_BTC_trend4h.bundle btc_4h_full_ext_20260811.csv
[✓] guest image id matches the program we trust [✗] zk receipt verifies (proof is real) [✓] committed journal matches credential (no swap) … every other line still checks — the ONE flipped bit is isolated … ────────────────────────────────────────────── One or more checks did not pass (marked [✗] above). This credential is not trustworthy as-is — it may be tampered, the wrong data, or a foreign engine. ❌ VERIFICATION FAILED — do not rely on this credential. exit code 1

This is what "cryptographic" means in practice: not our promise, but a mathematical object that refuses to mislead you even when we try to make it. Swap the spec, shrink the window, forge the parent digest, alter one bar of data — the verifier names the exact failure every time. There is no edit that survives.

One sealed strategy. A window that only grows.

A chained credential re-proves the same committed strategy over a strictly longer data window, the backtest becomes a growing live track, and every link is cryptographically bound: same spec commitment, same guest, the old window a Merkle prefix of the new. Re-verify the mechanics on the original chain pair from the v3 era — parent (800 bars) → extension (1,096 bars, +296 new).

$ chmod +x mizan-verifier-v3-macos-arm64 $ ./mizan-verifier-v3-macos-arm64 mizan_chain_extended.bundle btc_daily.csv --chain mizan_chain_parent.bundle
════════════════════════════════════════════════ MIZAN · INDEPENDENT VERIFIER (zero trust) ════════════════════════════════════════════════ [✓] guest image id matches the program we trust [✓] zk receipt verifies (proof is real) [✓] committed journal matches credential (no swap) [✓] data root recomputed from canonical CSV matches [✓] data root pinned to canonical allowlist: daily OHLC [✓] gate policy is the canonical MIZAN policy [✓] credential format v4 · exposure card · regime panel consistent [✓] annualization bound to the committed 1096-bar window [✓] committed cost model read from the journal: 7+3 bps per side [✓] GATE VERDICT is PASS (zk-attested) [✓] credential digest intact (tamper-evident) [✓] parent zk receipt verifies against the SAME trusted guest [✓] parent committed journal matches parent credential (no swap) [✓] CHAINED: same committed spec · window strictly extends parent (Merkle prefix) · parent digest matches 🔗 track: parent 800 bars → this credential 1096 bars (+296) · parent digest a4e4730816bcc442… ──────────────────────────────────────────────── GATE VERDICT : PASS ✓ (extended window) Metrics : Sharpe 1.41 · CAGR 36.5% · net 154.32% · MaxDD 17.36% Strategy : ***NEVER REVEALED*** ════════════════════════════════════════════════ ✅ INDEPENDENTLY VERIFIED, the same hidden strategy, re-proven over a strictly extended window, chained to its parent. Seventeen core conditions plus chain-continuity checks — twenty lines, all green.

What the chain proves, and what it doesn't: the chain check proves the same committed spec was honestly computed over the extended window (same guest, same gate, same costs; old window a Merkle prefix of the new). Provenance of the newly appended bars still rests on the canonical-data allowlist, not an exchange-signed feed — that boundary is printed by the verifier itself, not hidden.  ·  Break test: swap the spec, shrink the window, or forge the parent digest, the verifier refuses with the exact reason.  ·  Every credential minted in the app is chain-ready: one click re-proves it as data accrues.  ·  Verifier eras, honestly: a verifier binary trusts exactly the engine it was built with — verifier v3 (above) verifies everything minted from 2026-07-17; the original binary verifies the sample credential of its own era. Cross-era verification fails by design, not by accident.

Black-box models, proven: the gate ran inside the circuit.

Two credential families, both minted as real STARKs on 2026-07-17. Black-box FULL: a hidden model commits its positions forward into an append-only track, and the gate is computed in-circuit over that committed position stream, the credential attests these exact pre-committed positions cleared the gate on this exact data. zkML proven inference: a committed compact model runs its own decisions inside the circuit — every position provably came from that one hidden model. Tampering, curation and re-tuning are refused by construction — alter or drop any period and the sealed track head changes, so the credential fails. Forward-commitment timing: that positions were fixed before each period's outcome — rests on the track head being published or timestamp-anchored ahead of time, not on the circuit alone; anchoring it (OpenTimestamps / RFC-3161) is the honest completion of that claim. The model is never revealed.

$ ./mizan-verifier-v3-macos-arm64 mizan_blackbox_full.bundle btc_daily.csv --aux mizan_blackbox_full_parts.json --track mizan_blackbox_full_track_head.json

Since guest v10 · Fractional positions, a sealed model's sizing is now provable. Positions are no longer just long/flat/short: the committed stream carries a signed leverage per bar (×0.01 steps), a declared cap is enforced inside the circuit, and the parity and fractional commitment formats live in separate hash domains, a track committed one way can never replay as the other. The sample below is a hidden model whose dynamic sizing (avg 0.22×, peaks 1.24×) clears the full institutional gate — Sharpe 1.50 · CAGR 28.8% · MaxDD 20.8% · net +345%, all computed in-circuit. Minted as a real STARK on GPU, 2026-07-22.

$ ./mizan-verifier-v10-macos-arm64 mizan_blackbox_fractional.bundle btc_4h.csv --aux mizan_blackbox_fractional_parts.json --track mizan_blackbox_fractional_track_head.json
$ ./mizan-verifier-v3-macos-arm64 mizan_zkml.bundle btc_daily.csv --aux mizan_zkml_parts.json

Break test: change one byte of the parts file and re-run, the aux binding check fails and the verifier refuses the credential.  ·  Honest scope: the gate-in-circuit and compact-model inference above are proven — their receipts exist. Large-net zkML (proving inference of a big neural net in-STARK) remains a research frontier industry-wide; we don't relabel it.  ·  The original forward-track rail credential (verifies with the era -v2- binary) is kept as the historical artifact.

§ 04Deflated Sharpe · unfakeable N

Every backtest ever run, counted against the winner.

Try enough strategies and one will look brilliant by pure luck, and no ordinary track record shows you how many were tried. The DSR credential closes that hole: all N candidate trials are committed in a Merkle ledger, every trial's Sharpe is re-derived inside the circuit, and the winner's Sharpe is deflated for the luck of the best-of-N (Bailey & López de Prado's Deflated Sharpe Ratio — here made cryptographic). N is read from the ledger, never declared — understate it and verification fails. Minted as a real STARK on GPU, 2026-07-20. Since guest v10, significance is tested at an autocorrelation-corrected effective sample size: serially correlated returns can only make the test harder, never easier.

And it doesn't flatter its own maker. The credential below is real and verifies, but at the honest significance bar (DSR ≥ 0.95, Bailey–López de Prado's standard, not a coin flip), this particular strategy's edge does not survive the best-of-N correction. Our own verifier says so, out loud. A tool that stamped everything "significant" would be worthless; the whole value is that it tells you the truth, including when the truth is no.

$ chmod +x mizan-verifier-v10-macos-arm64 $ ./mizan-verifier-v10-macos-arm64 mizan_dsr.bundle btc_4h.csv --dsr --aux mizan_dsr_parts.json
════════════════════════════════════════════════ MIZAN · DSR VERIFIER (deflated Sharpe · N committed · trials proven) ════════════════════════════════════════════════ [✓] guest image id matches the program we trust [✓] zk receipt verifies (proof is real) [✓] committed gate journal matches the credential (no swap) [✓] gate policy is the canonical MIZAN policy [✓] the winning strategy cleared the gate (zk-attested) [✓] EVERY trial's Sharpe re-derived + bound in-circuit — V[SR] is proof-grade [✓] N == committed trial-ledger leaf count [✓] credential digest intact (tamper-evident) [✓] winner data root recomputed from YOUR CSV matches the committed root [✓] data root pinned to canonical allowlist: BTC 4h (OHLC) ──────────────────────────────────────────────── Trials committed (N) : 10 Observed Sharpe : 0.031 (per-obs) SR₀ (N-deflation) : 0.027 DEFLATED SHARPE (DSR): 0.6779 Significance bar : DSR ≥ 0.95 (Bailey–López de Prado) Verdict : NOT significant at 95% (DSR 0.68) — this edge does not survive multiple testing across N=10 trials Strategy : ***NEVER REVEALED*** ════════════════════════════════════════════════ ✅ DSR INDEPENDENTLY VERIFIED — N committed, every trial proven, deflation honest. (Verified = the deflation is computed honestly. The verdict above is what that honest computation returns.)

"Verified" is not "significant", and that distinction is the product. The green line certifies the deflation was computed honestly: N is real, every trial's Sharpe is proven, the math is right. What that honest math returns for this strategy is not significant at 95%: and the verifier says so plainly. A DSR of 0.68 means "more likely than not, but below the bar." Most edges land here; that is the entire reason the correction exists.  ·  What this proves, and what it can't: N counts the trials committed to this ledger from the moment it opened; no cryptography can recover experiments run before a ledger existed. The honest claim is "from here on, every trial is counted": never "we fixed history." That forward-only boundary is why the ledger is timestamp-anchored (Bitcoin + RFC-3161, files above): the commitment provably predates the outcomes.  ·  Break test: drop a losing trial from the ledger, fabricate a Sharpe, or restate N, each is refused with the exact reason; under-resolving trials fails closed.  ·  Verifier eras: the -v7- binary verifies engine-v7 credentials (this DSR one); the current era is -v11- (image 3ac3b10b… · both schools in-circuit; superseded eras verify forever); the DSR and PBO credentials below are v10 mints (composed PBO · n_eff DSR · fractional sizing), CPCV remains a v9-era mint and verifies with -v9- — its era's binary, forever; earlier eras keep their own binaries above — cross-era failure is by design.

§ 05PBO · backtest overfitting

Was the winner skill, or a lucky fit?

Even with N honestly counted, the selection itself can overfit: pick the in-sample best and it may sit below median out of sample, a backtest dressed as alpha. The Probability of Backtest Overfitting (Bailey–Borwein–López de Prado–Zhu, via combinatorially-symmetric cross-validation) prices exactly that: split the history into 16 sub-periods, and over every one of the 12,870 balanced train/test partitions — López de Prado's own published setting — check whether the in-sample best stays above median out of sample. All committed trials are re-derived inside the circuit; PBO is the fraction of partitions where the selection was luck. Bar: PBO ≤ 0.5. Minted as a real STARK on GPU, 2026-07-22.

This one passes, and it's now composed. Since guest v10 each committed trial is its own STARK, and the credential's aggregator proof cryptographically verifies every trial receipt inside itself before running the partition test on committed return moments — proofs checking proofs. That unlock is what pays for the full 12,870 partitions. The flagship trend selection reads PBO 0.0759: the in-sample-best config stays above the median out-of-sample, so the selection is skill, not overfitting. And the padding attacks stay closed — every committed trial must clear the institutional gate, the winner is bound to the maximum-Sharpe trial, the split is canonical, and (new, found by our own red-team before this mint) a ledger padded with clones of the winner is refused outright. Tracked openly as D7 and D9 on the security ledger.

$ chmod +x mizan-verifier-v10-macos-arm64 $ ./mizan-verifier-v10-macos-arm64 mizan_pbo.bundle btc_4h.csv --pbo
§ 06CPCV · leak-free cross-validation

Was the out-of-sample actually out of sample?

Cross-validation leaks when train and test overlap in time — serial correlation bleeds one into the other and flatters the result. Purged, embargoed combinatorial cross-validation (López de Prado, Advances in Financial ML, ch. 7 & 12) removes it: split into groups, hold out combinations as test, purge the label-overlap bars and embargo the boundary bars — in the circuit, with the purge count committed so a prover can't quietly skip it — then score the strategy across every recombined path for a distribution of OOS Sharpe, not one fragile split. The headline is the honest tail: the 5th-percentile path. Minted as a real STARK on GPU, 2026-07-22.

And this one holds. Across 15 recombined paths with 160 boundary bars purged+embargoed in-circuit, the flagship's 5th-percentile path Sharpe stays positive: the edge survives leak-free cross-validation, not just one lucky split.

$ ./mizan-verifier-v9-macos-arm64 mizan_cpcv.bundle btc_4h.csv --cpcv

All three sins, credentialed, and hardened. DSR (selection bias), PBO (overfitting) and CPCV (leakage) are each real STARK credentials you can re-verify here, the complete López de Prado framework — every correction a re-verifiable STARK credential. We red-teamed PBO and CPCV the same day we shipped them and found two real gaming vectors (D7, D8 on the security ledger): a paddable PBO ledger and an unenforced CPCV purge floor with a prover-chosen schema. Both are closed in guest v9: every PBO trial must clear the gate with the winner bound to the max, and the CPCV purge/embargo schema is a canonical constant with a per-path purge floor the verifier re-checks. We'd rather show you a credential, its holes, and the fix than a clean demo that hides them.

§ 07What the math guarantees

Seventeen conditions. All checked.

The verifier doesn't take MIZAN's word for anything, it recomputes and re-checks each of these from the raw bundle and your copy of the data. Seventeen conditions checked on a single credential — including exposures and regimes when the credential discloses them, as this sample does.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 PASS FAIL the lamp, not a door real proof? · untampered? · my data? · allowlisted? · published gate? · costs floored? · era named? … an honest-FAIL shows 16 green doors + the red lamp — and verifies perfectly chained credentials walk 3 extra doors (same strategy? window truly grew? parent intact?) → 20
Figure — Seventeen trust checks; the verdict is the lamp, not a door — an honest FAIL verifies perfectly.
1The program is the exact one we trust (guest image id)
2The zero-knowledge receipt is real and verifies
3The journal matches the credential — no swap
4The data root recomputes from your CSV
5The data root is a pinned canonical dataset — substituted history fails
6The gate policy is the canonical MIZAN policy
7The dataset was canonical inside the proof
8The credential declares the current format (v4 · disclosing · OHLC · intrabar-marked risk)
9The annualization basis is bound to the committed window — Sharpe can't be inflated
10The verdict is zk-attested — PASS or FAIL, sealed in-proof
11A strategy commitment is present (but hidden)
12The credential digest is intact — tamper-evident
13The exposure card is internally consistent (bands · leverage rail · instrument count)
14The regime policy is the pinned one — the prover cannot choose the buckets
15The regime panel is internally consistent (bar accounting · return rail)
16The regime bar counts re-derive from your own copy of the public data
17The verdict lamp. The seventeenth condition is the verdict itself, re-derived from the proof and displayed exactly as sealed — the lamp, not a door. It lights PASS or FAIL; either way the credential verifies. An honest FAIL walks all sixteen doors and shows the red lamp — and verifies perfectly. Chained credentials walk three extra doors (same strategy? window truly grew? parent intact?) → twenty.

Verifying is milliseconds; minting is not. Generating a proof is heavy, one-time work, a simple strategy on a daily dataset takes roughly 20–30 minutes on our single machine, and a multi-sleeve book on 4h data runs for hours. The Studio measures your exact proof cost up front and tells you before anything is queued; heavy books are minted offline. Verification stays seconds forever — that asymmetry is the whole point.

Seventeen pass. The strategy never leaves the proof. No trust in MIZAN required.

ENGINE v11 · 3ac3b10b… ● LIVE REGISTRY 77 CREDENTIALS · APPEND-ONLY VERIFY ~81 MS · OFFLINE · TRUSTING NO ONE ANCHOR BITCOIN #962,013 SPEC VTR-1 · FROZEN · CC BY ROOT 88298a2e…c6825a · MERKLE-COMMITTED