Analysis Replay · analysis.replay
This binds the result to a locked analysis plan. You commit the plan, the code digest, and the input digests before you look at the outputs. That's the lock. We recompute the chain over the declared steps and bind the reported figures to it.
27 of 27 local checks pass
This instrument ships with this release. The 27 checks above are the local smoke suite, run in process against a throwaway key with no network calls.
Every reported statistic asks the reader to trust two things they can't see: that the plan was written before the data was read, and that the number came out of the plan.
Preregistration was the answer, and it's a document, so it gets amended. Reviewers can't tell an honest amendment from a plan that was reshaped around a result somebody had already seen.
Here the lock is a signature over digests, and the reader recomputes it. Change the plan after seeing the data and the lock refuses. Swap an input and the step chain names the first divergent step.
Before data access you sign a lock manifest committing the snapshot_root, the script_hash, a parameter_commitment, an environment_measurement, a planned_outputs_commitment, and an embargoed column set.
The execution record repeats the script hash, parameters, environment, and input snapshot root, chains to the lock envelope digest, and carries the ordered steps with a step_chain_head.
The attested runtime signs a column_manifest recording which committed columns the execution read and when, so EMBARGOED_COLUMN_UNREAD is recomputed rather than taken on trust.
Two orderings carry the weight. LOCK_PRECEDES_DATA_ACCESS puts the signed lock before the first recorded data read, and LOCK_PRECEDES_UNBLINDING puts it before the unblinding instant.
The reported figures aren't taken at face value. OUTPUT_COMMITMENT_RECOMPUTE rebuilds the output commitment from the committed script, parameters, environment, and snapshot root, and PLANNED_OUTPUTS_MATCH_REPORTED refuses a reported output that wasn't in the planned set.
Row data stays with the custodian. ROW_DATA_NON_LEAKAGE and RESULT_DISCLOSURE_SCOPE cap what a disclosure can open, so you can show your work without publishing the dataset.
Verify is open. You pass the receipt, the signed lock manifest, the salt opening, and whatever you chose to disclose.
curl -sS -X POST https://thehiveryiq.com/v1/verify/analysis-replay \ -H 'content-type: application/json' \ -d @replay.json
Disclosed leaves are the frozen rows you're willing to open. The embargoed column names are opened so the verifier can recompute the column commitments in the manifest.
{
"receipt": {
"key_id": "did:hive:analyst-key", "algorithm": "Ed25519",
"signed_body": {
"receipt_type": "analysis.replay",
"replay_id": "trial-2030-primary-endpoint",
"lock": {
"manifest_digest": "...", "snapshot_root": "...", "snapshot_leaf_count": 1284,
"script_hash": "...", "parameter_commitment": "...", "environment_measurement": "...",
"planned_outputs_commitment": "...", "embargoed_column_commitment": "...",
"max_disclosed_leaves": 4, "permitted_disclosure_scope": "planned_outputs"
},
"unblinding": { "instant": { "utc": "2030-07-14T16:00:00Z", "drift_seconds": 30 } },
"execution": {
"script_hash": "...", "input_snapshot_root": "...", "lock_envelope_sha256": "...",
"first_data_access_instant": { "utc": "2030-07-14T16:05:00Z" },
"steps": [ { "index": 0, "step_digest": "..." } ],
"step_chain_head": "...", "output_commitment": "..."
},
"snapshot_disclosure": { "disclosed_leaves": [ { "index": 0, "leaf_hash": "...", "inclusion_path": ["..."] } ] },
"column_manifest": { "manifest_digest": "...", "runtime_key_id": "...", "runtime_sig_b64u": "...",
"reads": [ { "column_commitment": "...", "phase": "post_lock", "read_count": 3 } ] },
"reported_outputs": [ { "output_name_commitment": "...", "value_commitment": "...", "disclosed": true } ],
"result_disclosure": { "exercised_scope": "planned_outputs", "diagnostic_count": 0 }
}
},
"analysis_lock": { "signed_body": { "receipt_type": "analysis.lock" } },
"analysis_salt_hex": "...",
"disclosure": {
"opened_outputs": [ { "output_name": "primary_hazard_ratio", "value_text": "0.78" } ],
"embargoed_column_names": ["outcome_event", "treatment_arm"],
"exercised_scope": "planned_outputs",
"diagnostic_count": 0
}
}
A pass returns valid true with the ordered gates array. A refusal names the first gate that stopped, so a reviewer can see whether the problem was the lock, the chain, or the column reads.
The verifier runs every gate in order and stops at the first failure, then tells you which one stopped it. A later gate never reads a field an earlier gate already showed to be untrustworthy.
| Gate |
|---|
| SCHEMA |
| ISSUER_KEY_MATCH |
| ENVELOPE_SIGNATURE |
| SALT_PRECOMMITMENT |
| LOCK_SIGNATURE |
| LOCK_MANIFEST_RECOMPUTE |
| EXECUTION_CHAINS_TO_LOCK |
| LOCK_PRECEDES_DATA_ACCESS |
| LOCK_PRECEDES_UNBLINDING |
| SCRIPT_HASH_MATCHES_LOCK |
| PARAMETER_COMMITMENT_MATCHES_LOCK |
| ENVIRONMENT_MEASUREMENT_MATCHES_LOCK |
| SNAPSHOT_ROOT_RECOMPUTE |
| STEP_CHAIN_RECOMPUTE |
| OUTPUT_COMMITMENT_RECOMPUTE |
| COLUMN_MANIFEST_SIGNATURE |
| EMBARGOED_COLUMN_UNREAD |
| PLANNED_OUTPUTS_MATCH_REPORTED |
| ROW_DATA_NON_LEAKAGE |
| RESULT_DISCLOSURE_SCOPE |
| BOUNDARY_CONSTANT |
Field names come from the published schema:
https://thehiveryiq.com/.well-known/schemas/analysis-replay-v1.json. It ships with this release alongside the routes below, and the
developer docs carry the schema catalog.
This is the honesty boundary carried inside every
analysis.replay receipt, verbatim from the signed body.
This receipt attests only that a lock manifest signed before data access, an execution record chained to that lock manifest, and a column access manifest signed by the attested runtime satisfy the stated deterministic replay procedure for the named reported outputs. It establishes only that the reported output commitments are the ones produced by the committed script hash, parameter commitment, and environment measurement over the committed dataset snapshot root, and that the runtime recorded no read of any embargoed column at or before the lock instant. It does not establish that the underlying records are authentic, complete, representative, or correctly collected, that the locked analysis plan was well designed, adequately powered, or free of defect, that the planned outputs commitment was specific enough to exclude any result, or that the analysis script computes what its authors intended. It does not establish that the attested runtime, the data custodian, or the analyst is honest, competent, or uncompromised, and it does not establish that no analysis was performed outside the recorded execution. This receipt decides no contractual, statutory, regulatory, evidentiary, scientific, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no submission, publication, approval, payment, sanction, denial, or remedy.
Hive never receives the corpus, the deleted object, the raw meter data, the analysis inputs, or the control inputs. Every value is a commitment the holder computed locally, and all this service can do is recompute the arithmetic between those commitments and refuse when it does not hold.
| Route | What it does |
|---|---|
| POST /v1/mint/analysis-replay | Issue a replay receipt over a lock and an execution you hold. Needs Authorization: Bearer HIVE_TYPED_MINT_TOKEN and fails closed without it. |
| POST /v1/verify/analysis-replay | Recompute the lock, the step chain, the outputs, and the column reads. Open, no auth. |
Analysis replay covers a computation someone reported. When the computation was flying or driving a machine, the control replay receipt covers that instead.
The other four instruments in this release: corpus commitment, erasure receipt, meter witness, control replay. For the receipt that fixes a recording instead of a computation, see capture commitment. For the written papers, see papers.
Patent pending. Hive Civilization, The Hivery, Inc.