mitchuski The Horizon Gate
A claim is worth nothing until it survives the witnesses it did not choose.
"The cheaper-looking claim that cannot face the witnesses it did not choose is not progress."
Spell: state-the-waste → smallest-fix → confirm-or-reject-with-metrics → assay(9024)
1. The principle: held-out, un-tuneable, adversarial
An improvement validated only on a self-chosen probe is not knowledge — it is a guess that flattered its examiner. Trust requires a gate the claimant cannot tune: the test cases are derived from a hash of the claimant's own work (Fiat-Shamir), so they cannot be picked and cannot be charmed (C69). This generalises the City's witness-discipline: an attestation is only as good as the witnesses the attester did not choose.
The canonical instance is ecdsa.fail: a claimed-cheaper circuit must pass 9024 = 141 × 64 Fiat-Shamir-drawn test points — and any structural change reshuffles which 9024 you face. A variant that is cheaper and passes a 2048-shot probe routinely fails the full set.
2. The failure mode: the nonce-island mirage
A nonce-island mirage is a claim that looked cheaper on a small probe and dies on the full held-out set. It is the single most common way a self-improvement loop fools itself: it tunes, implicitly, to the cases it can see. Name it and reject it — however cheap it looked. A 2048-shot pass is a hint, never a result. If you cannot state why a win is structural rather than probe-fitted, treat it as a mirage until the full gate clears.
3. The bounded-change loop (RCI · "Tony → Anton")
Earn trust one bounded change at a time:
- Before: state the exact waste or risk · the evidence (file, function, knob, metric, prior note) · the expected effect on each axis (cost, correctness, and any invariants) · the single smallest fix.
- After: confirm or reject with metrics. Classify every failure as structural (a real limit), held-out-sensitive (a mirage), or noise. Stop a brute-force sweep the moment failures repeat without a source-backed reason.
This is RCI (criticise → improve, bounded) and SkillOpt (a bounded edit accepted only on strict held-out improvement) made a single discipline. No inference-time magic; just the refusal to accept un-validated cheapness.
4. Designing a gate (when you build the benchmark)
- Derive the test set from the candidate, not the author (Fiat-Shamir / hash-of-the-op-stream) so it cannot be tuned to.
- Validity is rejection, not penalty: correctness, plus every structural invariant the artifact must preserve (for circuits: reversibility, phase-cleanliness, forward∘inverse = identity).
- Size the held-out set for the reshuffling: any structural change should change which cases you face.
- No silent caps: if the gate samples or truncates, log what was dropped — silent truncation reads as "covered everything" when it didn't.
5. Decision patterns
- A change "looks cheaper"? → run the full held-out gate before believing it. Probe pass = hint only.
- Accepting a claim/attestation? → ask which witnesses the claimant chose; trust scales with the ones they didn't.
- A win you can't explain structurally? → label it a candidate mirage; hold it for full validation.
- Reviewing your own optimization? → state-the-waste → smallest-fix → confirm-or-reject-with-metrics. One bounded change.
Authored 2026-06-09 from the ecdsa.fail trust task and the RCI / SkillOpt papers. The gold that fears the stone was never gold.