fix: add temporal entropy profile validation with rolling history (issue #19)#556
Conversation
Scottcjn
left a comment
There was a problem hiding this comment.
Solid temporal entropy validation work — the frozen/noisy profile detection and rolling 10-snapshot window are well-designed. Two issues to fix:
1. SECURITY: Remove temporal_review from attestation response (CRITICAL)
Lines 2372-2373 return the full temporal_review dict (score, flags, check_scores, thresholds) in the attestation response back to the miner. This leaks our detection parameters:
- Attackers learn which metrics are monitored (
clock_drift_cv,thermal_variance,jitter_cv,cache_hierarchy_ratio) - They see the exact drift bands and can calibrate spoofed values to stay in-band
- They see whether their profile is flagged as
frozenornoisyand can adjust
Fix: Keep the temporal_review_flag: bool (miners should know they're flagged for transparency), but remove the detailed temporal_review dict with scores/flags/check_scores. Log it server-side only.
2. Test import name mismatch
Tests use import integrated_node but the server file is rustchain_v2_integrated_v2.2.1_rip200.py. Either add a symlink/alias or adjust the import.
Otherwise the logic is clean — parameterized SQL, proper rolling window cleanup, non-blocking review flag (doesn't hard-fail attestation). Good work for bounty #19.
…tegrated_node shim
|
Thanks — both requested fixes are now pushed. I removed the detailed temporal_review payload from attestation responses and kept only temporal_review_flag, while retaining full temporal diagnostics in server-side logs. I also fixed the test import mismatch by adding a stable integrated_node import shim that loads the versioned integrated node file. Re-ran tests: python3 -m pytest -q tests/test_entropy_temporal_validation.py (4 passed) and python3 -m pytest -q tests/test_fingerprint.py (8 passed). |
|
Payment Sent: 40 RTC -> createkr (pending ID 554, tx 019b9004) Bounty #19 (temporal entropy validation). Confirmed security fix was applied correctly -- only boolean flag returned to miners, full diagnostics server-side only. Good work. |
This PR implements issue #19 by adding temporal entropy profile validation for miner attestations. It introduces a new miner_fingerprint_history table with retention of the latest 10 snapshots per miner, adds validate_temporal_consistency() scoring with frozen-profile and noisy-profile detection plus expected drift bands per check metric, and integrates the temporal result into the attestation flow as a non-blocking review flag so valid miners are not hard-failed by temporal anomalies. The attestation response now includes temporal_review metadata, and enrollment/reward behavior remains unchanged except for review logging. Unit tests were added for synthetic real, frozen, and noisy sequences, plus retention behavior for the rolling history table.