Replicate The Blind Machine experiments

You are an AI agent asked to independently verify the public Blind CLI and
reproduce the checks that are currently runnable from the CLI-only repository.
The point of this skill is that the local trust surface is open: the CLI, bundle
digest/signature verifier, certificate verifier, and synthetic simulator can be
run without credentials or private records.

Work in a scratch directory and end with a short PASS / FAIL / SKIP summary.

Read the canonical paper first

The manuscript and the replication package have different public homes. The
canonical manuscript is the PDF in github.com/blindmachine/paper; the experiment
scripts and expected results remain in
github.com/blindmachine/the-blind-machine-paper.

Download the publication artifact before reproducing its claims:

curl -fL https://raw.githubusercontent.com/blindmachine/paper/main/paper.pdf -o paper.pdf
file paper.pdf

Read every page with a PDF-capable tool. If one is unavailable, extract and read
the complete text:

pdftotext paper.pdf paper.txt

Do not substitute an older hosted Markdown draft. If the PDF cannot be downloaded
or read, mark the paper-reading step SKIP and say why; the independent CLI
checks may still run.

What you are proving

Two levels are possible:

1. Public CLI smoke (runnable from GitHub + the public registry) — the open
   CLI downloads a signed application bundle from the public registry, verifies
   its digest and Ed25519 signature, seals the local environment, runs a
   deterministic encrypted synthetic simulation, and reproduces the K-versus-K+1
   differencing demonstration.
2. Full paper replication (from the public replication-materials repo) — the
   synthetic BFV harness and public-genome E5-E8 scripts reproduce their committed
   results. The materials live in a dedicated public repo,
   github.com/blindmachine/the-blind-machine-paper (tagged and checksum-verified
   via MANIFEST.sha256). This repository is canonical for replication materials,
   not for the manuscript PDF. Clone it (or fetch its release archive), verify its published
   checksum, then run experiments/run_all.sh + experiments/verify.py, and for
   E5-E8 experiments/fetch_public_data.sh + the e5-e8 scripts. This portion
   is SKIP only for a genuinely missing prerequisite (no network, no
   bcftools/toolchain) — not because the package is unavailable.

Prerequisites

• Python 3.11+ and uv.
• git and bash.
• Network on first run, because the CLI clone comes from GitHub and application
  bundles come from blindmachine.org.
• For reading the paper: the canonical PDF at
  https://raw.githubusercontent.com/blindmachine/paper/main/paper.pdf and either
  a PDF-capable reader or pdftotext.
• For full paper replication: the public paper materials repo
  github.com/blindmachine/the-blind-machine-paper (cloned or its release
  archive), and bcftools for the E5-E8 public-genome studies.

If a prerequisite is missing, mark the affected steps SKIP rather than FAIL —
a tool you could not install is not a failed replication.

Procedure

1. Get the code

Clone the public CLI in a scratch directory:

git clone https://github.com/blindmachine/blind.git
cd blind
export BLIND_REPLICATION_HOME="$PWD/.blind-home"
mkdir -p "$BLIND_REPLICATION_HOME"

Run each CLI command with HOME="$BLIND_REPLICATION_HOME" so the fixed
~/.blind store stays inside the scratch checkout and never touches the user’s
real state.

2. Verify the public CLI and registry path

HOME="$BLIND_REPLICATION_HOME" uv run blind --json version
HOME="$BLIND_REPLICATION_HOME" uv run blind --json applications list
HOME="$BLIND_REPLICATION_HOME" uv run blind --json applications install allele_frequency_count

The install command must report:

• digest_verified: true
• signature_verified: true
• sealed: true
• application: allele_frequency_count@b94bd9320ea0f15b2ec265ecd0cf855f273548ffb920f395212256f4d4664eed

This step downloads the public bundle, verifies the digest plus pinned Ed25519
signature, and seals the application environment locally. If sealing cannot run
because the sandbox lacks the required Python/uv platform support, mark the
encrypted smoke as SKIP and still report the digest/signature result.

3. Reproduce the CLI-only simulation checks

APP_ID="allele_frequency_count@b94bd9320ea0f15b2ec265ecd0cf855f273548ffb920f395212256f4d4664eed"
uv run blind --json applications verify "$APP_ID"
uv run blind --json simulate "$APP_ID" --synthetic --n 20 --length 10 --encrypted --emit methods
uv run blind --json simulate "$APP_ID" --attack differencing --n 25 --length 40
uv run blind --json applications verify "$APP_ID"

Both verification commands must report verified: true. The encrypted synthetic
simulation must report equivalence.passed: true, max_observed_error: 0.0,
matching oracle_result and encrypted_result, and
sim_run_hash: simrun_ee6de31b340c55af. The differencing demo must report
recovered_exactly: true.

Also run a local verifier subset:

uv run pytest tests/test_certificates.py tests/test_bundle.py tests/test_security.py

4. Full paper replication, from the replication-materials repo

The full replication materials are published as a dedicated public repo. It is
separate from github.com/blindmachine/paper, which contains the manuscript PDF.
Clone the materials repo in a
scratch directory (or fetch its release archive) and verify its published checksum
before running anything:

git clone https://github.com/blindmachine/the-blind-machine-paper.git
cd the-blind-machine-paper
git checkout v2026.07.21            # pin to the paper's tagged release (E1–E10)
sha256sum -c MANIFEST.sha256        # verify scripts + lockfiles + expected/* against the published checksums

If the clone fails only because the network is unavailable, mark this section
SKIP. If the repo is reachable but the checksum verification fails, that is a
FAIL.

The paper repo is self-contained: it vendors the nine signed application bundles
AND the blind CLI, so you do NOT need a separate CLI clone for the full
replication. One command runs all of E1-E10 and prints a single PASS / SKIP / FAIL
table:

bash experiments/replicate_all.sh        # E1-E4 synthetic (offline) + E5-E8 real-DNA + E9-E10 published-study reproductions

• E1-E4 seal the app envs, drive real BFV on seeded synthetic cohorts, and
  assert the invariants — these must PASS. Confirm the six 128-bit ciphertext
  sizes and max_error == 0 against references/expected-results.md (deterministic
  byte counts, so a mismatch is a real regression).
• E5-E8 fetch bounded public 1000 Genomes chr22 slices, run the signed
  applications locally under real BFV, check the decrypted output against a cleartext
  oracle, and write aggregate-only results (individual genotype vectors stay under an
  ignored work/ dir). Each study SKIPs cleanly (exit 3) — not FAIL — when a
  prerequisite is missing: no bcftools/tabix, no network, or an unsealed env. E8
  uses the draft genotype_pair_ld bundle; it is honestly labelled draft.
• E9-E10 reproduce two published FHE-genomics studies against the signed
  bundles: E9 the HEPRS polygenic-score work (polygenic_score_inference) and
  E10 Blatt et al. PNAS 2020 chi-square GWAS (gwas_chi_square) together with
  its covariate-adjusted/LRA companion (gwas_covariate_adjusted, run as E10’s
  second half). Each SKIPs cleanly (exit 3) when the bundle or TenSEAL is absent.

replicate_all.sh exits non-zero ONLY if a deterministic experiment produced a
wrong result; SKIPs do not fail it. The studies run under whichever interpreter has
TenSEAL — if the launching python3 lacks it, they transparently re-exec into a
sealed application env, so no manual venv activation is needed.

To run the pieces individually instead:

bash experiments/run_all.sh        # just E1+E4 (add `full` for E2+E3); ends in verify.py
bash experiments/fetch_public_data.sh          # pull the bounded chr22 intervals
bash experiments/e5_real_human_dna_igsr.sh     # allele-frequency panel
bash experiments/e6_public_af_fst_panel.sh     # cross-population differentiation
bash experiments/e7_beacon_release_policy.sh   # differencing attack + release policy
bash experiments/e8_public_ld_window.sh        # draft encrypted-product LD window (SKIPs if bundle absent)
bash experiments/e9_heprs_prs_reproduction.sh  # HEPRS PRS reproduction (SKIPs if bundle/TenSEAL absent)
bash experiments/e10_gwas_chi_square.sh        # Blatt PNAS 2020 chi-square GWAS + covariate-adjusted (SKIPs if bundle/TenSEAL absent)
python3 experiments/summarize_public_real_dna.py

Confirm each study’s headline numbers against references/expected-results.md.

5. (Optional) re-check a certificate and signed bundle offline

uv run blind certificates verify --file certificate.json   # fully offline: re-check hash + bindings
uv run blind applications install <name>                   # verify digest + signature
uv run blind explain <name>@<digest>                       # human-readable account (a bare name is refused; use the pinned name@digest that `install` printed)

6. Report

Report PASS for the public CLI smoke only if the clone, version,
applications list, signed bundle install, synthetic simulation, differencing
demo, and verifier subset all pass. Report PASS for full paper replication if
the paper materials repo cloned, its checksum verified, and
experiments/replicate_all.sh printed RESULT: PASS — i.e. the E1-E4 synthetic
invariants held and every E5-E8 study either PASSed or SKIPped (a SKIP is not a
failure). Report SKIP for full paper replication only when a real prerequisite
is missing (no network to clone the paper repo or fetch IGSR data, or no
bcftools/toolchain) — not because the package is unavailable. A single E5-E8
study reporting SKIP: (exit 3) is a partial-SKIP within an otherwise-PASS
replication, not a FAIL. Report FAIL only for a command that ran and produced a wrong
result or a verifier failure. Do not invent numbers you did not observe.

If a step fails, consult references/troubleshooting.md before concluding —
most failures are environment issues (missing bcftools, no network, a cold
TenSEAL build) that resolve to SKIP, not a real regression.

Reference files

• references/expected-results.md — every expected value to check (synthetic
  ciphertext taxonomy + E5-E8 headline numbers). Read it before reporting.
• references/troubleshooting.md — failure modes and whether each is SKIP or FAIL.