Adversarial Review: Multi-Model Cryptographic & Systems Audit Synthesis (GPT-OSS, Gemini Pro, Claude Opus)

[bootlace-dev]

Issue: Multi-Model Adversarial Audit Synthesis (GPT-OSS, Gemini Pro, Claude Opus) & Architectural Dispositions

Overview

We submitted the ground-truth monolithic machine context payload (llms-full.txt) for independent adversarial evaluation across three distinct model families:

1. GPT-OSS 120B
2. Gemini Pro (v3.7)
3. Claude 3.5 / Opus (Autonomous Systems Reviewer)

Below is the consolidated audit matrix detailing every raised concern, failure mode, and our formal architectural resolution.

---

1. Physical Entropy & Key Derivation

Audit Finding / Edge Case	Raised By	Status	Resolution & Defensive Rationale
Min-Entropy Floor on 50 Rolls: $50 \times \log_2(6) \approx 129.25$ bits is tight against the 128-bit floor. Leftover Hash Lemma dictates a larger safety margin if consumer dice have manufacturing defects.	GPT-OSS, Pro	[FUTURE ROADMAP]	Increase Dice Floor to 60 Rolls: The math is sound under uniform distribution, but consumer casino/board-game dice may exhibit minor physical face bias. Bumping the default roll requirement to 60 rolls ($\approx 155.1$ bits raw entropy) guarantees $\ge 128$ bits extracted uniform min-entropy even with biased physical dice.
Uniform Bias vs. Markov Transition Blindspot: Real-time Markov filtering ($P \le 0.85$) blocks sequence repetition (123456...), but is blind to static mechanical bias (e.g. weighted dice favoring face 6).	Pro	[CONSCIOUS DESIGN CHOICE]	Mathematical Proof: If a die is heavily biased (e.g., face 6 lands 30% of the time instead of 16.6%), the Shannon entropy per roll drops from $2.585$ to $\approx 2.45$ bits. Over 60 rolls, total entropy remains $>145$ bits, which SHA-256 compresses into a 128-bit seed. Markov guards against human cognitive failure; oversampling guards against physical die defects.
Zero Hardware RNG Salting ($H(\text{User} \oplus \text{TRNG})$): Lack of hybrid entropy removes the safety net if user rolls are flawed.	GPT-OSS, Pro	[WON'T-DO]	Anti-Kleptography Invariant: Injecting closed-source silicon TRNGs re-introduces the exact supply-chain trojan / kleptographic backdoors (e.g., Dual_EC_DRBG, timer glitching) SubZero was built to eliminate. Seed generation must remain 100% deterministic and auditable with paper/dice.

---

2. Footgun Elimination & Threat Boundaries

Audit Finding / Edge Case	Raised By	Status	Resolution & Defensive Rationale
Duress Wallets ($5 Wrench Attack): Omission of 13th-word passphrases eliminates plausible deniability / decoy wallets under physical coercion.	Pro	[WON'T-DO]	Zero Unchecksummed Footguns: BIP39 passphrases lack error-detecting checksums. A single character casing mistake or trailing whitespace silently generates a valid, empty phantom wallet—causing irrecoverable silent capital loss. For physical duress, users should maintain a separate funded hot wallet on mobile via BIP85 child seeds.
Delegated Spending Risk: Omitting PSBT signing avoids parser bugs but delegates the most dangerous phase of the crypto lifecycle to downstream signing software.	GPT-OSS, Pro	[CONSCIOUS DESIGN CHOICE]	Scope Separation: Complex transaction and script parsers account for $>80%$ of historical hardware wallet CVEs. SubZero is strictly a sovereign cold vault generator and BIP85 distributor. Spending is decoupled to ephemeral child keys or dedicated airgapped signers.

---

3. Systems Architecture & Amnesic Memory Model

Audit Finding / Edge Case	Raised By	Status	Resolution & Defensive Rationale
V8 / JavaScript String Immutability: While Uint8Array buffers are explicitly zeroed via .fill(0), intermediate JS strings remain in V8 GC heap until DRAM decay.	GPT-OSS, Opus, Pro	[CONSCIOUS DESIGN CHOICE]	Documented in AD-03: All sensitive cryptographic material (raw entropy, SHA-256 digest, BIP32 root key) is held strictly in typed Uint8Array allocations and zeroed immediately. Mnemonic word strings displayed on /dev/tty1 rely on immediate physical power-off and DRAM capacitor discharge.
Physical USB Ejection Verification: Prompting the user to pull the USB post-boot relies on human compliance rather than a kernel-enforced lock.	GPT-OSS	[CONSCIOUS DESIGN CHOICE]	Documented in AD-06 / Section 4: The rootfs is loaded 100% into volatile tmpfs (toram), and the boot media is cleanly unmounted by early initramfs. The physical drive can be removed at any point. No write operations or persistence hooks exist in the OS.
Kernel Network Demolition & Residual Blobs: Physical deletion of kernel/net and network drivers blocks exfiltration, but inert blobs could exist in /lib/firmware.	GPT-OSS, Opus	[REMEDIATED]	Build Script Hardened: scripts/build_alpine_kiosk.sh physically wipes /lib/modules/*/kernel/net, /lib/modules/*/kernel/drivers/net, drivers/wireless, drivers/usb/net, and all wireless firmware blobs from /lib/firmware. Raw network sockets cannot be opened at the syscall level.
Sub-OS Abstraction Leaks (Intel ME / AMD PSP / UEFI): Generic COTS hardware contains sub-OS management engines that operate below the Linux kernel.	Pro	[CONSCIOUS DESIGN CHOICE]	COTS Over Targeted Honeypots: Sub-OS firmware is completely inert without an active network controller or attached persistent storage to exfiltrate to. Banning proprietary microcontrollers and using discarded COTS laptops eliminates targeted supply-chain interdiction.

---

4. MicroPython Comparison & Engine Verification

Audit Finding / Edge Case	Raised By	Status	Resolution & Defensive Rationale
Single-Turn Formal Auditability: TypeScript cryptographic engine (~730 lines, ~4,000 tokens) can be verified in a single turn by AI, unlike multi-megabyte C/Python RTOS stacks.	GPT-OSS, Opus, Pro	[VALIDATED / CORE MOAT]	Core Architectural Advantage: Proves the thesis of AI-first software verification. A user or model can audit the entire cryptographic engine (src/crypto.ts) and TUI state machine (src/tui.ts) in seconds with zero hidden layers.
Language Fragmentation on Cyberdecks: Porting to bare-metal C/Rust for pocket hardware (Cardputer/T-Deck) risks divergence from the TypeScript reference engine.	GPT-OSS	[FUTURE ROADMAP]	Shared Test Vector Suite: Any future C/Rust implementation for embedded cyberdecks will be verified against the identical 20-vector test suite (tests/crypto_audit.test.ts) before release.