Threat model and paper draft, adversarially produced - and the IK claim was false

Two documents drafted by a subagent fan-out, two per item, adversarially
looped: drafter -> hostile critic (verify every number against BENCH-netem.md,
every mechanism against the source; the code wins over the docs) -> reviser,
three rounds each; the critics failed every round, which is where the quality
came from. 14 agents, ~1.25M tokens.

docs/THREAT-MODEL.md - Phase 0 of the audit plan, code-verified. Its findings
are the point:
 - THE HANDSHAKE IS NOT NOISE IK. core/Handshake.kt has no initiator static and
   no responder ephemeral: it is N-pattern-shaped (e, es) hybridized with
   ML-KEM. NOTICE and AUDIT-PLAN said IK; both corrected. Consequences the
   threat model now states plainly: the initiator is cryptographically
   anonymous (anyone with the server's published keys can connect), and
   first-flight forward secrecy is bounded by both server statics.
 - The ticket key is a concentrated-risk asset: one operator key roots ticket
   encryption, retry tokens, AND stateless-reset tokens - compromise yields
   recorded-resumed-session keys, off-path connection kills, and validation
   bypass at once. An auditor should start there.
 - Resumed sessions have no forward secrecy at all (no fresh DH/KEM on the
   resumption path); strictly weaker than fresh connects.
 - Two stale in-code comments flagged (StatelessReset.kt header-protection and
   idle-timeout claims vs the authoritative code).

docs/paper/DRAFT.md - the arXiv cs.NI draft. The abstract is the calibration
the week earned: the mechanism account labelled inferred-not-packet-traced, the
CC comparison hedged at n=3 per arm, the FEC side's own 2.7 s low-rate boundary
reported against itself, 11 [CITE:] placeholders and one [VERIFY] instead of
invented references. Every load-bearing number spot-checked against
BENCH-netem.md after generation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: 3x3xX3N0N

NOTICE

@@ -59,7 +59,15 @@ and academic work, implemented from the documents rather than from any codebase:
                            lengths. No crypto primitive is implemented in this
                            repository.
   FIPS 203                 ML-KEM
-  Noise Protocol Framework the IK handshake pattern
+  Noise Protocol Framework the one-flight pre-shared-responder-key premise. CORRECTED
+                           2026-08-29: earlier revisions of this file said "the IK
+                           handshake pattern"; the code (core/Handshake.kt) has no
+                           initiator static and no responder ephemeral - it is
+                           N-pattern-shaped (e, es) hybridized with ML-KEM, a
+                           misstatement found by adversarial review of the threat
+                           model and verified against the source. Consequences in
+                           docs/THREAT-MODEL.md (no initiator identity, first-flight
+                           forward secrecy bounded by both server statics).
   Homa (Ousterhout et al.) receiver-driven credit scheduling
   kwik (tech.kwik)         benchmark-only dependency of :bench (`bench vs`): an
                            independent, spec-derived Java QUIC implementation

docs/AUDIT-PLAN.md

@@ -15,9 +15,11 @@ bugs by itself.
 
 ## Phase 1 — formal handshake delta (weeks, nearly free)
 
-The handshake is Noise IK, which already has machine-checked proofs (Noise Explorer, Kobeissi/Bhargavan). The
-job is therefore NOT to prove the handshake — it is to document every deviation from the proven model and show
-each one either maps onto it or stands as an open question:
+CORRECTED 2026-08-29 (adversarial review of the threat model, verified against core/Handshake.kt): the
+handshake is NOT Noise IK as this plan and NOTICE previously said — there is no initiator static and no
+responder ephemeral. It is N-pattern-shaped (e, es) hybridized with ML-KEM. Noise Explorer's machine-checked
+proofs cover the N pattern too, but the proven properties are weaker (no initiator authentication; forward
+secrecy of the first flight bounded by the responder statics) and the delta document must start from N, not IK:
 - ML-KEM hybridization into the key schedule (FIPS 203 + X25519)
 - 0-RTT resumption tickets and the replay window (core/Resumption.kt, core/ZeroRtt.kt)
 - the key-rotation chain (secret_{n+1} = HKDF(secret_n); KeyPhaseState)