Skip to content

fix: add temporal entropy profile validation with rolling history (issue #19)#556

Merged
Scottcjn merged 2 commits intoScottcjn:mainfrom
createkr:fix/issue-19-temporal-entropy
Mar 4, 2026
Merged

fix: add temporal entropy profile validation with rolling history (issue #19)#556
Scottcjn merged 2 commits intoScottcjn:mainfrom
createkr:fix/issue-19-temporal-entropy

Conversation

@createkr
Copy link
Contributor

@createkr createkr commented Mar 3, 2026

This PR implements issue #19 by adding temporal entropy profile validation for miner attestations. It introduces a new miner_fingerprint_history table with retention of the latest 10 snapshots per miner, adds validate_temporal_consistency() scoring with frozen-profile and noisy-profile detection plus expected drift bands per check metric, and integrates the temporal result into the attestation flow as a non-blocking review flag so valid miners are not hard-failed by temporal anomalies. The attestation response now includes temporal_review metadata, and enrollment/reward behavior remains unchanged except for review logging. Unit tests were added for synthetic real, frozen, and noisy sequences, plus retention behavior for the rolling history table.

@createkr createkr requested a review from Scottcjn as a code owner March 3, 2026 16:36
@github-actions github-actions bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related tests Test suite changes labels Mar 3, 2026
@github-actions github-actions bot added the size/L PR: 201-500 lines label Mar 3, 2026
Copy link
Owner

@Scottcjn Scottcjn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Solid temporal entropy validation work — the frozen/noisy profile detection and rolling 10-snapshot window are well-designed. Two issues to fix:

1. SECURITY: Remove temporal_review from attestation response (CRITICAL)

Lines 2372-2373 return the full temporal_review dict (score, flags, check_scores, thresholds) in the attestation response back to the miner. This leaks our detection parameters:

  • Attackers learn which metrics are monitored (clock_drift_cv, thermal_variance, jitter_cv, cache_hierarchy_ratio)
  • They see the exact drift bands and can calibrate spoofed values to stay in-band
  • They see whether their profile is flagged as frozen or noisy and can adjust

Fix: Keep the temporal_review_flag: bool (miners should know they're flagged for transparency), but remove the detailed temporal_review dict with scores/flags/check_scores. Log it server-side only.

2. Test import name mismatch

Tests use import integrated_node but the server file is rustchain_v2_integrated_v2.2.1_rip200.py. Either add a symlink/alias or adjust the import.

Otherwise the logic is clean — parameterized SQL, proper rolling window cleanup, non-blocking review flag (doesn't hard-fail attestation). Good work for bounty #19.

@createkr
Copy link
Contributor Author

createkr commented Mar 3, 2026

Thanks — both requested fixes are now pushed. I removed the detailed temporal_review payload from attestation responses and kept only temporal_review_flag, while retaining full temporal diagnostics in server-side logs. I also fixed the test import mismatch by adding a stable integrated_node import shim that loads the versioned integrated node file. Re-ran tests: python3 -m pytest -q tests/test_entropy_temporal_validation.py (4 passed) and python3 -m pytest -q tests/test_fingerprint.py (8 passed).

@Scottcjn Scottcjn merged commit 50135af into Scottcjn:main Mar 4, 2026
5 checks passed
@Scottcjn
Copy link
Owner

Scottcjn commented Mar 4, 2026

Payment Sent: 40 RTC -> createkr (pending ID 554, tx 019b9004)

Bounty #19 (temporal entropy validation). Confirmed security fix was applied correctly -- only boolean flag returned to miners, full diagnostics server-side only. Good work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/L PR: 201-500 lines tests Test suite changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants