Distributed Thermodynamic Security: Two Conditional-If Theorems and One Open Conjecture

Arthur Gardner
NanŌmics PBC, Delaware, USA
info@nanomics.io

Draft for IACR ePrint Archive — Version 1.8 · 2026-09-20
May 2026 model text, carried forward. Version 1.7 added Theorem A (the α^n many-room stack). Version 1.8 adds Theorem B (the modeled sum: query-bounded leftover, signature, replay remainder, Sybil count, and Stage 2 leftover in the sum). The accept rule and the printed assumptions are unchanged. Companion editions are Whitepaper 1.4 and DTS PUBLISH-4.4 (pointers only). The files posted at nanomics.io/resources are Whitepaper 1.4 and DTS PUBLISH-4.4. Version 1.7 is unchanged and remains the prior freeze. The Gardner Conjecture remains an open conjecture in the field. No ePrint send.

Abstract

We introduce Distributed Thermodynamic Security (DTS), a security architecture class combining (i) min-entropy from consumer multisensor physical environments, (ii) cryptographic epoch commitments, (iii) geographically distributed honest participation, and (iv) stacked Bayesian Q validation — independent per-node posterior tests P(genuine | features) whose joint false-accept rate scales as α^n. We formalize a security game DTS-Forge, state explicit assumptions, and present the Gardner Conjecture: under these assumptions, adversary advantage Adv(A) tends to zero as hash strength k, chain depth t, and effective honest participation n increase. The composite bound includes α^n as the dominant term at large n (Bayesian stack), alongside 2^(-k), 2^(-h·n), 2^(-n), and temporal neg(t).

The accept rule has two stages. An epoch is accepted only when both stages pass on that same signed epoch. Stage 1 is the posterior on the room the witness sits in. The verifier runs its Bayesian stack over the submitted environment reading and that reading must clear two gates: a quality gate, which asks whether the sample is good enough to judge, and a matching gate, which asks whether it looks like the room the witness was enrolled as. Stage 1 is about this room, on this node, in this epoch. Stage 2 is the five-class conjunction — physical AND cryptographic AND logistical AND statistical AND temporal — holding in that same signed epoch. Accept only if both stages pass. One miss on either stage and the record is not accepted. The two stages together are the accept rule. It is a definition, not a theorem, and no printed assumption is attached to it. The per-room parameter α does not enter the accept rule.

The printed assumptions — hash hardness, a per-room Stage 1 false-accept parameter, and no shared cheat across rooms — attach to the many-room product and to nothing else. Under those assumptions the joint Stage 1 false-accept rate across n independently certified rooms is at most α^n. That bound is Theorem A. It is the ε_validator term of the bound. An n-room forgery requires both stages at each room: **Forge_n = ∧_i (S1_i ∧ S2_i). Forge_n is contained in the event that Stage 1 passes at every room, so α^n** is also an upper bound on Forge_n. Stage 2 is not multiplied against Stage 1 as if the two were independent draws. Theorem B is the modeled full sum under printed ifs, stated later in this draft. Neither Theorem A nor Theorem B is the Gardner Conjecture, which remains open.

We describe an instantiation on a deployed Proof-of-Physics beacon and report red-team results in which five scripted forgery classes were rejected by the full Bayesian posterior, not correlation thresholds alone (May 2026, production entropy validator). Those results sit on Stage 1, on one node. They are labeled Demonstrated. A second laboratory experiment (11 September 2026) exercised Stage 2 on one enrolled-write path. That board is an experiment, not a Demonstrated result.

Keywords: physical entropy, min-entropy, multisensor attestation, Merkle commitments, distributed security, randomness beacons

1 Introduction

Cryptographic systems traditionally derive assurance from computational hardness (factoring, discrete logarithms, hash preimage resistance) or from specialized physical processes (radioactive decay, hardware security modules, quantum key distribution). Physical random number generation is well studied, but prior deployed architectures rarely combine environment-coupled min-entropy from COTS sensors, including smartphones, epoch-level cryptographic binding, and network-scale independent participation in a single verification pipeline.

We propose Distributed Thermodynamic Security (DTS) as a named category for this conjunction. The thesis is not that any single layer is novel—Merkle trees, min-entropy extraction, and multisensor fusion are known—but that their composition under explicit adversary games defines a distinct design space: an adversary must simultaneously defeat physical plausibility checks, cryptographic commitments, and (when required) multi-site logistics.

This paper contributes:

1. A formal security game and assumption set for DTS beacons.
   
2. Theorem A — Adv ≤ α^n under printed ifs — and Theorem B — the modeled full sum under printed ifs. Neither closes Conjecture 1.
   
3. The Gardner Conjecture, a decomposed bound on adversary advantage (open conjecture; proof roadmap in Section 9).
   
4. A layered security model with consistent metrics (information, computation, logistics, time).
   
5. An instantiation sketch and empirical red-team evaluation of a production validator stack.

We do not claim a completed theorem proof in the sense of a reduction to a single hard problem; we publish the model to enable peer review. No post-quantum primitive is claimed as built. A Mac laboratory enrollment row stores an ML-DSA-87 public key beside Ed25519, and a record on that row verifies only when both signatures verify over the same bytes; an Ed25519-only signature is not that row. The record path on that row agrees a connection secret with ML-KEM-1024 and X25519, and the row is refused unless both halves succeed. That row is not the May 2026 measurement reported here and not the live deployment pin; both verify Ed25519 only. No quantum-mechanical result and no theorem about superintelligent adversaries is used or claimed.

2 Related Work

Computational cryptography. Hash preimage resistance and digital signatures provide binding and authenticity [Merkle, 1979; RFC 8032].

Min-entropy and extraction. Randomness extraction and min-entropy estimation for physical sources are standardized in NIST SP 800-90B and analyzed in modern extraction literature [Shannon, 1948; Dodis, Reyzin and Smith, 2004].

Physical RNG and QRNG. Radioactive and quantum random number generators offer physical unpredictability but typically require dedicated hardware and lack consumer-scale network participation [Herrero-Collantes & Garcia-Escartin, 2017].

Proof-of-work. Bitcoin ties ledger security to computational work; it does not authenticate physical environment entropy [Nakamoto, 2008].

Chaos and acoustics. Sensitive dependence in dynamical systems motivates difficulty of long-horizon simulation of room acoustics [Lyapunov; Strogatz].

Group-forming networks. Reed’s Law describes economic value scaling of group-forming networks as 2^n [Reed, 2001]; we treat this as ecosystem economics, not a per-forgery success probability, unless a protocol explicitly encodes subset constraints.

3 Preliminaries

Let H map bit-strings to k-bit hashes (written H: {0,1}* → {0,1}^k) and be modeled as a random oracle with k-bit preimage resistance (classical 2^k work; Grover 2^(k/2) in ideal quantum models).

Let h denote a lower bound on min-entropy (bits) per honest epoch contribution after validator acceptance.

Let ρ ∈ [0,1) bound pairwise correlation among honest spatially separated sources.

Let n denote the count of honest, geographically distinct participants in an epoch window after Sybil and co-location controls.

Let t denote temporal chain depth (number of prior epoch commitments linked).

Let C_site denote the cost for an adversary to sustain one convincing physical site per epoch (economic or operational units).

Acceptance — two stages. An epoch is accepted when both stages pass on the same signed epoch.

• Stage 1 (S1). The posterior on this room. The submitted environment reading must clear a quality gate and a matching gate.
  
• Stage 2 (S2). The five-class conjunction: physical (the environment signal is genuine), cryptographic (the epoch is signed by the enrolled key and the signature verifies), logistical (the witness is in the place it was enrolled to), statistical (the reading matches the enrolled baseline inside the policy gate), and temporal (the epoch is fresh and unused). On the Mac laboratory enrollment row the cryptographic class is met only when an ML-DSA-87 signature and the Ed25519 signature both verify over the same bytes; the live deployment pin verifies Ed25519 only.

Write A_i = S1_i ∧ S2_i for room i. The two stages together are the accept rule. It is a definition. No printed assumption is attached to it. No single class carries an accept, and Stage 2 alone is not the accept rule. The statistical and physical class bits of Stage 2 are set from the same server-side evaluation that produces the Stage 1 posterior. They are not independent draws.

4 Security Model

4.1 Honest beacon B(n, t, k)

An honest beacon:

1. Captures multisensor features (V, A, K, …) from environment ω ∈ Ω_physical.
   
2. Applies validator V (statistical tests T).
   
3. Signs a canonical message; commits polHash to an epoch Merkle root.
   
4. Optionally anchors the root at ledger depth t.

4.2 Adversary A

A is probabilistic polynomial-time with API access to public epoch state. A may submit forged payloads with adversary-generated keys but lacks genuine physical presence at n distinct elements of Ω_physical (defined operationally by passing V under honest calibration).

4.3 Game DTS-Forge(A, n, t, k)

1. Challenger initializes B(n, t, k).
   
2. A submits forged entropy payloads.
   
3. A wins if any forgery is accepted under the two-stage rule of Section 3 — Stage 1 and Stage 2 on that same signed epoch — and included in the epoch Merkle commitment (or equivalent production acceptance policy).

Advantage: Adv(A) = Pr[A wins].

For n independently certified rooms in the same window the forgery event is

**Forge_n = ∧_i (S1_i ∧ S2_i)**, for i = 1 … n.

Every room must clear its own posterior and its own five classes. Success at one room is not granted at another.

The same DTS-Forge win condition defines acceptance for the laboratory entropy API used in the September 2026 experiment (Section 8). The live Physical Reality Sentry deployment pin is a separate system and is not the subject of that experiment.

4.4 Assumptions

5 Gardner Conjecture

Conjecture 1 (Gardner, 2026). Under assumptions A1–A5,

Adv(𝒜) ≤ 2^−k + 2^{−h ⋅ n} + 2⁻ⁿ + αⁿ + neg(t) + ε_sybil(n_adv)

Decomposed form:

Adv(𝒜) ≤ ε_hash(k) + ε_entropy(n, h, ρ) + ε_network(n) + ε_validator(α, n) + ε_replay(t) + ε_sybil(n_adv)

Suggested forms:

• ε_hash(k) ≤ 2^(-k) (classical)
  
• ε_entropy(n, h, ρ) ≤ 2^(-n·h_eff(ρ)) where h_eff decreases with ρ
  
• ε_network(n) ≤ 2^(-n) (logistics / configuration)
  
• ε_validator(α, n) ≤ α^n — stacked Bayesian Q (P4); α ≈ 10^(-6) to 10^(-9) per node after calibration
  
• ε_replay(t) → 0 under fresh epoch nonces and signature binding
  
• ε_sybil controlled by enrollment policy

Multiplicative form (AND): Pr[forge] ≤ 2^(-k) · 2^(-h·n) · 2^(-n) · α^n · neg(t) (tighter; additive form above is conservative union bound). We use multiplicative / AND form for this bound to avoid a name clash with the term product elsewhere in the corpus.

P4 — Bayesian validator stack: Each node computes P(genuine | V_t, A_t, K_t, cross_modal_variance, acoustic_SNR, nonce_match) from modality likelihoods and prior. Adversary must evade all n validators; exact likelihood models and α calibration are trade secrets (the conjecture discloses that stacking exists and α^n is the bound term, not the underlying recipe).

Proposition (posterior stack, under printed assumptions). Assume (i) H is preimage resistant; (ii) each room’s Stage 1 false-accept rate under its own posterior is at most α, where α is a parameter here and is not a measured fleet quantity; and (iii) rooms do not share one cheat — a single adversary artifact does not raise the accept probability in a second room. Then the joint Stage 1 false-accept rate across n independently certified rooms is at most α^n, which is the ε_validator(α, n) term used above. This is a statement about the posterior stack under the printed assumptions. It does not prove Conjecture 1. The printed assumptions belong to this proposition and to the n-room product. They are not attached to the two-stage accept rule of Section 3, and by themselves they accept nothing.

Containment. Forge_n is contained in the event that Stage 1 passes at every room. The two-stage rule is strictly harder to satisfy than Stage 1 alone, so under the three printed assumptions the Stage 1 product also bounds Forge_n. Stage 2 is not multiplied against Stage 1 as an independent factor. Writing α^n × p_AND^n would count the same evidence twice. This paper therefore quantifies the many-room bound on the Stage 1 term alone and leaves the Stage 2 margin unquantified.

Definitional check (two-stage accept). The accept rule of Section 3 — Stage 1 and then Stage 2 on the same signed epoch — is the English definition of acceptance; only the Stage 2 half has been stated in machine-checkable form as a definition check. The Stage 2 half verifies the shape of the five-class conjunction (all five must hold). The check carries no printed assumptions and no α: it is the definition of the accept rule. It is not a proof of Conjecture 1 and does not upgrade the conjecture to a theorem.

Mechanized lemmas

The Stage 2 half of the definitional check above, together with three supporting statements that sit under the model, has been written out and checked by machine in Lean 4 with mathlib. Each is given here in English first and by file second. Lean source is not reproduced in this paper. The tree is open_items/dts_lemmas/dts_l2/ in the author’s working corpus and is available to reviewers on request.

1. The five-class conjunction of Stage 2. The machine-checked statement is Stage 2 and only Stage 2: a record is accepted exactly when all five classes — physical, cryptographic, logistical, statistical, temporal — hold on that record, and a miss on any one class is not an accept. The file carries no Stage 1 object: the quality and matching gates of Stage 1 are not machine-checked here. The two-stage rule of Section 3 — Stage 1 and then Stage 2 on the same signed epoch — remains the English definition of acceptance in this paper, and it is not what this file compiles. The statement carries no printed assumption and no α. File: DtsL2/Conjunction.lean.

2. Rooms stack to α^n. If each certified room’s Stage 1 false-accept probability is at most α, and the joint probability across rooms is the product of the per-room probabilities, then the joint Stage 1 false-accept probability across n rooms is at most α^n. This is the machine-checked form of the proposition above, under the same printed assumptions. File: DtsL2/Rooms.lean, lemma rooms_joint_le.

3. Commitment separation and replay. Producing a leaf that verifies under a published Merkle root, without already holding that leaf, yields a preimage for the hash function; and an epoch whose nonce has already been used is rejected. Both statements are relative to an assumed hard hash function. Neither is a proof about SHA-256 or Ed25519 as deployed primitives. File: DtsL2/L1.lean.

4. Distinguishability for a fixed guess. If no single outcome of an honest epoch contribution carries weight above 2^(-h), then a guess named in advance of the draw matches with probability at most 2^(-h), and at most 2^(-n·h) across n contributions when the joint weight is the product of the per-site weights. The bound is for a guess fixed before the draw. An adversary that reads the published receipt and adapts to it is not covered. File: DtsL2/Basic.lean, lemmas l2a_guess and l2b_nfold.

The project builds. lake build DtsL2 completed successfully on 2026-09-19.

What the build does not establish is stated here so that no reader has to infer it.

• It does not prove Conjecture 1. The composite bound of this section has no machine-checked proof, and the conjecture remains open.
  
• It does not measure α. Item 2 takes α as a printed parameter, exactly as the proposition above does.
  
• It does not cover an adversary that reads a published receipt and adapts. Item 4 is a fixed-guess bound only.
  
• It does not quantify the Stage 2 residual margin left open by the containment argument above.
  
• The tree carries further files that are not load-bearing for this paper — among them an enterprise composition stated as a disjunction, and support definitions. They compile. They are not the theorem, and no claim here rests on them.
  
• Leftover key material is out of scope for this draft. No lemma above bounds it, and none is claimed.

The companion pre-NDA editions — DTS PUBLISH-4.4 and Physical Reality Sentry Whitepaper 1.4 — point to this list rather than restating it.

Finish A compose

Assume the union bound: adversary advantage is at most the sum of six named allowances — hash, entropy, network, validator, replay remainder, and Sybil. Assume also the printed bounds on the first four: hash ≤ 2^{-k}, entropy ≤ 2^{-n·h} for a guess fixed before the draw, network ≤ 2^{-n}, validator ≤ α^n. Then

Adv ≤ 2^{-k} + 2^{-n·h} + 2^{-n} + α^n + ε_replay + ε_sybil.

The network and Sybil allowances remain parameters. The replay remainder is what is left after a used nonce is rejected. The entropy bound is the fixed-guess bound of item 4 above; an adversary that reads a published receipt is not covered. The Stage 2 leftover of the containment argument is not a term on the right-hand side. It stays open.

This is a statement under those ifs. It is not a proof of Conjecture 1. File: DtsL2/FinishA.lean, lemma finish_a_union. lake build DtsL2 completed successfully on 2026-09-20. The two-term enterprise composition compose_hash_and_rooms is not this lemma.

Theorem A — the α^n many-room stack under printed ifs

Assume (i) advantage is at most the joint Stage 1 false-accept — the n-room forge sits inside Stage 1 at every room — (ii) that joint chance is the product of the per-room Stage 1 chances, and (iii) each room’s Stage 1 chance is at most the parameter α. Then

Adv ≤ α^n.

That is the many-room posterior stack of the proposition above and of item 2 in the lemma list (rooms_joint_le). The product is derived from the per-room bounds. It is not taken as a premise. Stage 2 is not independently quantified. The May 2026 figure ≈ 0.826 and the band 10^{-6}–10{-9} are not this α.

If those extra displayed terms are nonnegative, the six-term line is a loose corollary of Adv ≤ α^n. It is not a proof of hash, leftover surprise, network, replay, or Sybil.

This is not a proof of Conjecture 1. File: DtsL2/Rooms.lean, lemma rooms_joint_le. lake build DtsL2 completed successfully on 2026-09-20. Finish A finish_a_union is not this lemma.

Theorem B — the modeled sum under printed ifs

Assume the union-if: advantage is at most the sum of hash, q times a leftover-surprise unit, network, validator, signature, replay remainder, Sybil, and Stage 2 leftover. Assume also the printed bounds hash ≤ 2^{-k}, leftover unit ≤ 2^{-n·h}, network ≤ 2^{-n}, validator ≤ α^n, and that the faker holds m < n enrolled sites. Then

Adv ≤ 2^{-k} + q·2^{-n·h} + 2^{-n} + α^n + ε_sig + ε_replay + ε_sybil + ε_S2.

The leftover term is query-bounded. It is not a bound on every adaptive faker. ε_S2 is in the sum. Replay is one object (not neg(t)). α is a parameter. This is a statement under those ifs. It is not a proof of Conjecture 1 in the field. File: DtsL2/Opus5.lean, lemma theorem_b. lake build DtsL2 completed successfully on 2026-09-20. Theorem A (the α^n stack) and Finish A (finish_a_union) are not this lemma.

Corollaries

Corollary (Merkle separation). Recovering a leaf commitment from the published root without breaking H requires preimage work Ω(2^k) classically.

Corollary (conditional monotonicity). Advantage decreases in k and t. Advantage decreases in n only under A2 and A5 (distinct honest sites).

6 Layered Architecture

Security cost to the adversary grows multiplicatively in log-space across independent layers (physics × crypto × logistics), not as a single conflated exponent. The two-stage accept rule is the definition of one-epoch acceptance. It is not a sixth layer in this table.

7 Instantiation: Proof-of-Physics Beacon

The instantiation evaluated in Section 8 is the May 2026 production entropy validator. The live Physical Reality Sentry deployment is a separate system and is not the machine measured here.

We instantiate V as stacked Bayesian inference over:

1. Modality likelihoods L(V_t | genuine), L(A_t | genuine), L(K_t | genuine) — correlation checks reject impossible joints.
   
2. Cross-modal variance likelihood — decorrelated statistical mimicry rejected.
   
3. Acoustic SNR / variance likelihood — synthetic flat audio rejected.
   
4. Full posterior P(genuine | features) > τ — joint hypothesis test (not threshold-only).
   
5. Ed25519 signature binding and epoch-scoped canonical messages. The Mac laboratory enrollment row also requires an ML-DSA-87 signature over the same bytes and is not the machine measured in Section 8.
   
6. Merkle aggregation of per-wallet polHash values per epoch.

Honest participation uses COTS sensors, including smartphones with camera, microphone, and motion sensing. No radioactive source, HSM, or QKD link is required—this is the deployment accessibility separator for DTS.

Trade secret: exact likelihood models, priors, α calibration, τ accept thresholds, and tier tables are implementation-defined and omitted here.

8 Empirical Evaluation

We executed five scripted forgery classes plus one genuine control against a production entropy API with unified posterior gate (May 2026). Full results: ENTROPY_ATTACK_PROOF_2026-05-26.md.

All forgeries used valid Ed25519 signatures. Attacks reaching V failed the posterior gate. The accept threshold is implementation-defined and omitted here. Mimicry frame yields calibrated α ≈ 0.826 per node. That figure is a Stage 1 stacking input. It is not a pass rate, not a product claim, and not the two-stage per-room rate. This battery ran on one node and exercised Stage 1. It is labeled Demonstrated. It is not a test of Stage 2.

Internal estimate. Under independence, joint Stage 1 false-accept is ≈ 5.0×10⁻⁹ at n = 100 and ≈ 9.6×10⁻⁸⁴ at n = 1,000 (~276 bits). These are internal estimates derived from the single measured per-node α; they are not a measured 1,000-node deployment and not a measured two-stage fleet rate.

Genuine-epoch operational cost on the measured path is about $0.0008 per accepted event with a ledger memo, and about $0.00004 without (11 June 2026 bench; both below $0.001). The older $0.17 figure was participant burden, not operational cost, and is not used here. Attack-cost heuristics for naive and hard-variance classes remain orders of magnitude above that genuine cost. Statistical mimicry remains expensive relative to genuine and is still rejected.

Experiment 2 (lab, 11 September 2026). A separate laboratory battery exercised Stage 2 on one enrolled-write path. Forty-seven attack-surface cases were run. Forty-five held. Two honest controls were accepted. Residual count zero. This was a lab experiment. It is not the live deployment, it is not a Demonstrated result, and it does not change the May 2026 result. The laboratory entropy API uses the same DTS-Forge win condition; the live Sentry deployment pin is not the subject of that experiment.

The board ran a stolen enrolled key, a wrong room pin, and a used-epoch replay as three separate cases: the stolen key failed on the cryptographic class (bad_signature), the wrong room pin failed on the physical class (physical_fail), and the replay failed on the temporal class (temporal_fail). There is no board row that is a stolen key used from a different room with the signature verified. The accept rule still covers that harder case: a signature that does verify must still clear the remaining classes in the same epoch.

Artifacts, by SHA-256:

• Attack surface board: open_items/dts_lab_V_Stack_plus5_1.0/receipts/ATTACK_SURFACE_MATRIX_2026-09-11.md — sha256 c657efa49c122d456a086f5ffeccb07783cdfebed9549f4b74ef7ef47d81bcc5 · posted at https://nanomics.io/resources/ATTACK_SURFACE_MATRIX_2026-09-11.html
  
• Combined receipt: open_items/dts_lab_V_Stack_plus5_1.0/receipts/attack_proof_2026-09-11.json — sha256 faadc405b987c23ea2537e93225a316c86e1f208a4bb07edfdac8338c59a35ff
  
• May 2026 reference receipt: measurements/measurements_Latest/attack_proof_2026-05-26.json — sha256 1574f260fce8b7a477ef2542c4757a751fd65e1f576eb51356ca5d4b0ba51bbc

Limitation: Stub likelihoods demonstrate architecture; production calibration is trade secret. Tests bound α for scripted attacks only; they do not prove Adv(A) ≤ ε for adaptive adversaries. The α^n stacking term applies when an adversary must pass n independent Stage 1 validators simultaneously.

9 Limitations and Open Problems

1. Proof of Conjecture 1 under explicit V and feature distributions.
   
2. Min-entropy measurement of COTS sensor modalities, including smartphones, at scale (SP 800-90B methodology).
   
3. ROC calibration for α, β across synthetic corpora.
   
4. Sybil resistance formalization (A5) tied to geographic attestation.
   
5. Bell’s theorem is not used as a lemma for CMOS noise; shot/thermal models suffice.
   
6. Presentation-attack detection under ISO/IEC 30107-3, including a per-room false-accept bound (α for the physical class), remains unmeasured.
   
7. Room independence. Printed assumption (iii) of the Section 5 proposition — that rooms do not share one cheat — is a modeling assumption. It has not been measured across a deployed fleet.
   
8. Stage 2 residual. The unquantified Stage 2 margin of Section 5 remains unquantified. Characterizing Stage 2 against an adversary that has already cleared Stage 1 is future work.

10 Conclusion

Distributed Thermodynamic Security names an architecture class: physical min-entropy + cryptographic commitment + distributed participation on consumer hardware. We provide a game-based model, two theorems under printed ifs (Theorem A, the α^n stack; Theorem B, the modeled sum), the Gardner Conjecture, and initial empirical evidence that layered validators reject naive forgeries. The accept rule has two stages: this room’s posterior, then the five-class conjunction on the same signed epoch. That rule is a definition. The printed assumptions sit on Theorem A and Theorem B. We invite cryptographic review of the Gardner Conjecture, which remains open, and independent red-teaming of the model and its acceptance rule.

References

• Bell, J.S. (1964). On the Einstein-Podolsky-Rosen Paradox. Physics 1(3):195–200.
  
• Dodis, Y., Reyzin, L., and Smith, A. (2004). Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data. In Advances in Cryptology — EUROCRYPT 2004.
  
• Gardner, A. (2026). Physical Reality Sentry Platform™ — Technical Whitepaper, Version 1.4. NanŌmics PBC. Companion edition to this draft. The file posted at https://nanomics.io/resources/PHYSICAL_REALITY_SENTRY_WHITEPAPER_PRE_NDA_v1.html is edition 1.4.
  
• Gardner, A. (2026). Distributed Thermodynamic Security — PUBLISH-4.4. NanŌmics PBC. Companion edition to this draft. The file posted at https://nanomics.io/resources/GARDNER_DTS_SECURITY_MODEL_PUBLISH_v1.html is edition 4.4.
  
• Gardner, A. (2026). Entropy Attack Proof, 26 May 2026. measurements/measurements_Latest/attack_proof_2026-05-26.json (sha256 1574f260fce8b7a477ef2542c4757a751fd65e1f576eb51356ca5d4b0ba51bbc).
  
• Gardner, A. (2026). Attack Surface Matrix, 11 September 2026 (laboratory). open_items/dts_lab_V_Stack_plus5_1.0/receipts/ATTACK_SURFACE_MATRIX_2026-09-11.md (sha256 c657efa49c122d456a086f5ffeccb07783cdfebed9549f4b74ef7ef47d81bcc5). https://nanomics.io/resources/ATTACK_SURFACE_MATRIX_2026-09-11.html
  
• Gardner, A. (2026). Combined attack receipt, 11 September 2026 (laboratory). open_items/dts_lab_V_Stack_plus5_1.0/receipts/attack_proof_2026-09-11.json (sha256 faadc405b987c23ea2537e93225a316c86e1f208a4bb07edfdac8338c59a35ff).
  
• Gardner, A. (2026). Epoch COGS Benchmark, 11 June 2026. measurements/measurements_Latest/EPOCH_COGS_BENCHMARK_v1.md. Conservative Sentry-style cost ≈ $0.0008 per accepted event; production entropy path ≈ $0.00004; both below $0.001.
  
• Herrero-Collantes, M. and Garcia-Escartin, J.C. (2017). Quantum random number generators. Rev. Mod. Phys.
  
• Josefsson, S., Liusvaara, I. (2017). RFC 8032: Edwards-Curve Digital Signature Algorithm.
  
• Lyapunov, A.M. (1892). The General Problem of the Stability of Motion.
  
• Merkle, R.C. (1979). A Certified Digital Signature. CRYPTO 1979.
  
• Nakamoto, S. (2008). Bitcoin: A Peer-to-Peer Electronic Cash System.
  
• NIST SP 800-90B. Recommendation for the Entropy Sources Used for Random Bit Generation.
  
• Reed, D.P. (2001). The law of the pack. Harvard Business Review.
  
• Shannon, C.E. (1948). A Mathematical Theory of Communication. Bell System Technical Journal 27(3):379–423.
  
• Strogatz, S.H. (2015). Nonlinear Dynamics and Chaos.

© 2026 Arthur Gardner / NanŌmics PBC. Draft for ePrint submission. Not submitted. Contact: info@nanomics.io