Analysis Replay · analysis.replay

A reported result is a claim about a computation nobody else ran.

This binds the result to a locked analysis plan. You commit the plan, the code digest, and the input digests before you look at the outputs. That's the lock. We recompute the chain over the declared steps and bind the reported figures to it.

27 of 27 local checks pass

This instrument ships with this release. The 27 checks above are the local smoke suite, run in process against a throwaway key with no network calls.

The fight this ends

Every reported statistic asks the reader to trust two things they can't see: that the plan was written before the data was read, and that the number came out of the plan.

Preregistration was the answer, and it's a document, so it gets amended. Reviewers can't tell an honest amendment from a plan that was reshaped around a result somebody had already seen.

Here the lock is a signature over digests, and the reader recomputes it. Change the plan after seeing the data and the lock refuses. Swap an input and the step chain names the first divergent step.

Here is the shape

01

Lock the plan

Before data access you sign a lock manifest committing the snapshot_root, the script_hash, a parameter_commitment, an environment_measurement, a planned_outputs_commitment, and an embargoed column set.

02

Run it and chain the steps

The execution record repeats the script hash, parameters, environment, and input snapshot root, chains to the lock envelope digest, and carries the ordered steps with a step_chain_head.

03

Prove nothing peeked

The attested runtime signs a column_manifest recording which committed columns the execution read and when, so EMBARGOED_COLUMN_UNREAD is recomputed rather than taken on trust.

What holds it together

Two orderings carry the weight. LOCK_PRECEDES_DATA_ACCESS puts the signed lock before the first recorded data read, and LOCK_PRECEDES_UNBLINDING puts it before the unblinding instant.

The reported figures aren't taken at face value. OUTPUT_COMMITMENT_RECOMPUTE rebuilds the output commitment from the committed script, parameters, environment, and snapshot root, and PLANNED_OUTPUTS_MATCH_REPORTED refuses a reported output that wasn't in the planned set.

Row data stays with the custodian. ROW_DATA_NON_LEAKAGE and RESULT_DISCLOSURE_SCOPE cap what a disclosure can open, so you can show your work without publishing the dataset.

Verify one yourself

Verify is open. You pass the receipt, the signed lock manifest, the salt opening, and whatever you chose to disclose.

curl -sS -X POST https://thehiveryiq.com/v1/verify/analysis-replay \
  -H 'content-type: application/json' \
  -d @replay.json

Disclosed leaves are the frozen rows you're willing to open. The embargoed column names are opened so the verifier can recompute the column commitments in the manifest.

{
  "receipt": {
    "key_id": "did:hive:analyst-key", "algorithm": "Ed25519",
    "signed_body": {
      "receipt_type": "analysis.replay",
      "replay_id": "trial-2030-primary-endpoint",
      "lock": {
        "manifest_digest": "...", "snapshot_root": "...", "snapshot_leaf_count": 1284,
        "script_hash": "...", "parameter_commitment": "...", "environment_measurement": "...",
        "planned_outputs_commitment": "...", "embargoed_column_commitment": "...",
        "max_disclosed_leaves": 4, "permitted_disclosure_scope": "planned_outputs"
      },
      "unblinding": { "instant": { "utc": "2030-07-14T16:00:00Z", "drift_seconds": 30 } },
      "execution": {
        "script_hash": "...", "input_snapshot_root": "...", "lock_envelope_sha256": "...",
        "first_data_access_instant": { "utc": "2030-07-14T16:05:00Z" },
        "steps": [ { "index": 0, "step_digest": "..." } ],
        "step_chain_head": "...", "output_commitment": "..."
      },
      "snapshot_disclosure": { "disclosed_leaves": [ { "index": 0, "leaf_hash": "...", "inclusion_path": ["..."] } ] },
      "column_manifest": { "manifest_digest": "...", "runtime_key_id": "...", "runtime_sig_b64u": "...",
        "reads": [ { "column_commitment": "...", "phase": "post_lock", "read_count": 3 } ] },
      "reported_outputs": [ { "output_name_commitment": "...", "value_commitment": "...", "disclosed": true } ],
      "result_disclosure": { "exercised_scope": "planned_outputs", "diagnostic_count": 0 }
    }
  },
  "analysis_lock": { "signed_body": { "receipt_type": "analysis.lock" } },
  "analysis_salt_hex": "...",
  "disclosure": {
    "opened_outputs": [ { "output_name": "primary_hazard_ratio", "value_text": "0.78" } ],
    "embargoed_column_names": ["outcome_event", "treatment_arm"],
    "exercised_scope": "planned_outputs",
    "diagnostic_count": 0
  }
}

A pass returns valid true with the ordered gates array. A refusal names the first gate that stopped, so a reviewer can see whether the problem was the lock, the chain, or the column reads.

What gets checked

The verifier runs every gate in order and stops at the first failure, then tells you which one stopped it. A later gate never reads a field an earlier gate already showed to be untrustworthy.

Every gate the verifier runs, in order (21 gates)
Gate
SCHEMA
ISSUER_KEY_MATCH
ENVELOPE_SIGNATURE
SALT_PRECOMMITMENT
LOCK_SIGNATURE
LOCK_MANIFEST_RECOMPUTE
EXECUTION_CHAINS_TO_LOCK
LOCK_PRECEDES_DATA_ACCESS
LOCK_PRECEDES_UNBLINDING
SCRIPT_HASH_MATCHES_LOCK
PARAMETER_COMMITMENT_MATCHES_LOCK
ENVIRONMENT_MEASUREMENT_MATCHES_LOCK
SNAPSHOT_ROOT_RECOMPUTE
STEP_CHAIN_RECOMPUTE
OUTPUT_COMMITMENT_RECOMPUTE
COLUMN_MANIFEST_SIGNATURE
EMBARGOED_COLUMN_UNREAD
PLANNED_OUTPUTS_MATCH_REPORTED
ROW_DATA_NON_LEAKAGE
RESULT_DISCLOSURE_SCOPE
BOUNDARY_CONSTANT

Field names come from the published schema: https://thehiveryiq.com/.well-known/schemas/analysis-replay-v1.json. It ships with this release alongside the routes below, and the developer docs carry the schema catalog.

What this receipt does not say

This is the honesty boundary carried inside every analysis.replay receipt, verbatim from the signed body.

This receipt attests only that a lock manifest signed before data access, an execution record chained to that lock manifest, and a column access manifest signed by the attested runtime satisfy the stated deterministic replay procedure for the named reported outputs. It establishes only that the reported output commitments are the ones produced by the committed script hash, parameter commitment, and environment measurement over the committed dataset snapshot root, and that the runtime recorded no read of any embargoed column at or before the lock instant. It does not establish that the underlying records are authentic, complete, representative, or correctly collected, that the locked analysis plan was well designed, adequately powered, or free of defect, that the planned outputs commitment was specific enough to exclude any result, or that the analysis script computes what its authors intended. It does not establish that the attested runtime, the data custodian, or the analyst is honest, competent, or uncompromised, and it does not establish that no analysis was performed outside the recorded execution. This receipt decides no contractual, statutory, regulatory, evidentiary, scientific, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no submission, publication, approval, payment, sanction, denial, or remedy.

Hive never holds the underlying data

Hive never receives the corpus, the deleted object, the raw meter data, the analysis inputs, or the control inputs. Every value is a commitment the holder computed locally, and all this service can do is recompute the arithmetic between those commitments and refuse when it does not hold.

Endpoints

RouteWhat it does
POST /v1/mint/analysis-replayIssue a replay receipt over a lock and an execution you hold. Needs Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed without it.
POST /v1/verify/analysis-replayRecompute the lock, the step chain, the outputs, and the column reads. Open, no auth.

Where this sits

Analysis replay covers a computation someone reported. When the computation was flying or driving a machine, the control replay receipt covers that instead.

The other four instruments in this release: corpus commitment, erasure receipt, meter witness, control replay. For the receipt that fixes a recording instead of a computation, see capture commitment. For the written papers, see papers.

Patent pending. Hive Civilization, The Hivery, Inc.