docs: add canonical chart audit provenance and opt-in-by-default anonymous DHT security guarantees

README.md

@@ -11,6 +11,13 @@ pinned: true
   <a href="https://norvitech.com"><img alt="NorviTech Suite — open-source apps for the Linux desktop and the self-hosted stack" src="https://norvitech.com/assets/banner.svg" width="800"></a>
 </p>
 
+<p align="center">
+  <a href="https://huggingface.co/NorviTech/armiger-ultra"><img alt="Armiger v2.1.0 Release" src="https://img.shields.io/badge/Armiger_Suite-v2.1.0-FD8024.svg"></a>
+  <a href="https://huggingface.co/NorviTech/armiger-ultra/blob/main/benchmarks/CHARTS_MANIFEST.json"><img alt="Canonical Statistical Chart Audit" src="https://img.shields.io/badge/Chart_Audit-6%2F6_Invariants_Locked-10B981.svg"></a>
+  <a href="https://huggingface.co/NorviTech/armiger-ultra/blob/main/docs/ANONYMOUS_OPT_IN_DHT.md"><img alt="DHT Sharing Opt-In & Anonymous" src="https://img.shields.io/badge/DHT_Sharing-Opt--In_%26_100%25_Anonymous-0284C7.svg"></a>
+  <a href="https://github.com/spencernorton/DH-Waypoint"><img alt="DH-Waypoint v5.6.0" src="https://img.shields.io/badge/DH--Waypoint-v5.6.0-6366F1.svg"></a>
+</p>
+
 **NorviTech** builds fast, compact, self-hosted neural models and systems tools for the Linux desktop and the self-hosted stack.
 
 ## 1. Armiger Core Neural Models (Audited Unmutated Ground-Truth Benchmarks)
@@ -42,6 +49,32 @@ Both **[`NorviTech/armiger-ultra`](https://huggingface.co/NorviTech/armiger-ultr
 
 ---
 
+## Canonical Statistical Chart Audit & Cryptographic Provenance (`v2.1.0`)
+
+All benchmark charts and headline metrics across the Armiger `v2.1.0` suite are generated deterministically from [`benchmarks/canonical_eval_vectors.json`](https://huggingface.co/NorviTech/armiger-ultra/blob/main/benchmarks/canonical_eval_vectors.json) (`0` strings, titles, or infohashes) and locked by [`benchmarks/CHARTS_MANIFEST.json`](https://huggingface.co/NorviTech/armiger-ultra/blob/main/benchmarks/CHARTS_MANIFEST.json) under four machine-enforced invariants (`pytest benchmarks/test_chart_integrity.py`):
+
+1. **Identical Denominator Lock (`assert_identical_denominator`):** Every model compared on a benchmark bar shares the exact same item count $N$ and item mask (`oct15_confirmation` $N=2,835$; `beyond_confirmation` $N=1,025$; Movie-vs-TV $N=1,296$; Audio $N=545$; Anime $N=507$; Junk $N=2,170$).
+2. **Non-Circular Teacher Evaluation Lock (`assert_non_circular_teacher_eval`):** Frontier teacher models (`gpt-6-luna`, `gemini-3.8-flash-low`) are evaluated strictly via **Leave-One-Teacher-Out (LOTO)** reference keys (`self_vote_weight = 0.0`), removing $+1.47\text{ pp}$ and $+1.81\text{ pp}$ of circular self-vote inflation.
+3. **Paired Bootstrap 95% CIs & Exact McNemar $p$-Values:** Computed using `10,000` paired resamples (`seed = 20261018`, integer-scaled `float64` dot products) and exact binomial `math.comb` McNemar tests (`p = 1.42e-11` vs. `gemini-3.8-flash-low` LOTO; `p = 3.88e-24` vs. `claude-haiku-4-5`).
+4. **Deterministic PNG Chunk Stripping:** Output PNGs contain only `IHDR`, `IDAT`, and `IEND` chunks with pinned SHA-256 digests (`2367dbf6...`, `ff33da1a...`, `a4ebfcb1...`, `b137523c...`).
+
+---
+
+## Privacy & Anonymous Opt-In-By-Default DHT Sharing (`opt_in_sharing=False`)
+
+Distributed DHT intelligence sharing (`NorviTech/armiger-calibration-dht` and `NorviTech/armiger-dht-db-sync`) is **strictly opt-in by default** and **100% anonymous by construction** when enabled (see [`docs/ANONYMOUS_OPT_IN_DHT.md`](https://huggingface.co/NorviTech/armiger-ultra/blob/main/docs/ANONYMOUS_OPT_IN_DHT.md) and [`benchmarks/anonymous_opt_in_proof_report.json`](https://huggingface.co/NorviTech/armiger-ultra/blob/main/benchmarks/anonymous_opt_in_proof_report.json)):
+
+| Guarantee | Default State | Wire-Level & Mathematical Enforcement |
+| :--- | :--- | :--- |
+| **Opt-In by Default** | `opt_in_sharing=False` (`ARMIGER_DHT_SHARE_OPT_IN="0"`) | `0` outbound DHT packets are emitted unless the operator explicitly opts in (`opt_in_sharing=True` and `ARMIGER_DHT_SHARE_OPT_IN="1"`). |
+| **`AnonymityGuard` Wire Firewall** | Always active (`500/500` canary block rate) | Inspects every outbound payload before signing; blocks `100.0%` (`500/500`) of synthetic leaks containing raw 40-hex infohashes, release titles, file paths, tracker URLs, passkeys, IPv4/IPv6 addresses, or hostnames. |
+| **Ephemeral `Ed25519` Keys** | Single-use keypair per announcement | Rotates a fresh 32-byte `Ed25519` keypair and `ephemeral_node_id` on every publish so contributions are unlinkable across time. |
+| **Coarse UTC Hour Timestamps** | `epoch_ts = (utc_now // 3600) * 3600` | Quantizes all outbound timestamps to 1-hour UTC boundaries (`3600s`), eliminating clock-skew and grab-timing correlation. |
+| **DP-Clipped Weight Deltas** | `clip_norm = 1.0`, `noise_multiplier = 0.05` | Clips calibration/adapter update vectors in $L_2$ norm (`<= 1.0`) and adds calibrated Gaussian noise ($\sigma = 0.05$) before hybrid `X25519` + `ML-KEM-768` + `ChaCha20-Poly1305` encryption. |
+| **`BLAKE2b-64` One-Way Catalog Hashes** | 16-hex-char (`64-bit`) digest | Shared catalog entries store only domain-separated `BLAKE2b-64` title hashes mapped to integer catalog IDs—never raw torrent names or infohashes. |
+
+---
+
 ## Intended Use & Legal Compliance
 
 `Armiger`, `Armiger Ultra`, and all bundled plugins are open-source machine learning and cryptographic metadata-classification utilities designed strictly for **lawful use cases**, including: