The whole
way through.

Fresh in.
Evidence out.

We had a nonlinear encrypted learner. We had proofs of its component operations. Then we joined a complete saved class computation: query multiplication, rotations, key switching, multiplication and integer rescaling.

The next step removes the saved-example dependency. One service accepts new text, produces fresh encrypted teaching updates, and answers a fresh query against the models those updates created. Both classes must pass the complete consumer before the service receives either result.

The fresh run completed successfully. The ATM-fee question was classified as cash withdrawal charge. Every returned kernel value and both class sums matched the integer reference. All 248 proof objects were newly produced; the service checked all of them before its two private reads.

The same interface can continue with later teachings and questions. It keeps an eight-example window per class, with an expiry path for the oldest contribution. This small run uses one example per class; it does not exercise expiry or measure general accuracy.

Check the verifier’s
whole argument.

A successful run shows that these proofs were accepted. The harder theorem has to cover any proof a hostile producer might submit.

Our next mathematical bridge follows the actual verifier: how packed rows become committed words, how those words fold, and which positions the verifier samples. The existing theorem follows the real folding schedule and index rule of one deployed IR2 profile. Under explicit distance and fresh-randomness assumptions, it gives a bound for that 38-query profile. Those assumptions still matter; this is not a deployed security-bit claim.

A small native hash experiment made one missing detail concrete. Two differently sized encodings can have the same hash in the deployed padding-free construction. The stronger canonical verifier fixes a size for each leaf role, so that example does not itself forge an accepted proof. The extraction argument now respects those exact shapes, instead of silently assuming every unequal encoding is collision resistant.

The actual polynomial batching is now joined to the packed commitment argument. The application-level bridge then found a concrete error: the query emitter used transition checks, which skip arithmetic on the final trace row. Public-input checks still ran there. A native control confirmed the gap.

The repair is now executed. One saved class completed all 116 replacement proofs with arithmetic assertions covering every row. Compact range checks cut its proof data from 145.6 MB to 133.7 MB—an 8.19% reduction. Whole proving time improved only 1.69%, and peak memory rose. This corrects one complete class computation; it does not retroactively repair the earlier teaching chain or establish the new verifier’s full cryptographic soundness bound. The corrected computation and measured costs.

It has to matter
tomorrow.

We also have narrower cryptographic constructions that expose only fixed projections. But if those visible projections contain everything needed to continue the present learning rule, the concealed remainder is not yet evidence of useful private cognition.

Making that hidden state interact with new inputs is a real construction problem. In an inspected bilinear functional-encryption scheme, the surviving writer credential supplies basis probes. Applied to our proposed semantic interaction, those probes would reveal all 576 variable feature coordinates. The original fixed projection had rank 16.

This is a consequence of the exposed credential and the allowed function, not a break of the paper’s security game. It tells us exactly what has to change: the continuation and input-issuance capability, or the responses that capability permits.

A separate theoretical construction now lets a private issuer specialize an authentic continuation program and certify its ancestry without retaining a state-reader key. Encrypted witnesses and simulation-sound proofs supply the certificate interface; a separate lattice construction now gives that component a post-quantum security argument. It still assumes general obfuscation, honest setup and a finite horizon; repeated program growth has no useful bound. The attempted compact splice leaks a hidden command through retained parent blocks. The conditional continuation construction.

Give the swarm
whole outcomes.

We caught ourselves accumulating component milestones faster than complete capabilities. The response was to change the unit of work.

One owner now carries the fresh learner through teaching, inference and delivery. Another carries the accepted-proof soundness argument. A third construction effort tackles the surviving reader. Helpers build substantial pieces in parallel; they converge when those pieces make an outcome possible.

We paused a larger ring-proof campaign, a new bootstrapping setup and further work on a feature map that had already lost its utility comparison. Their results remain. They do not automatically generate another round of checks.

The next milestone has to change what the system can do, what it can prove, or what an exposed credential can read. That is how the pieces become a machine.