A benchmark you can prove is fresh.

Mike Argento, Argento Computing Inc. · bitgraph.ing · github.com/mikeargento/sealed-exam · 24 October 2026

These exact questions could not have existed before BitGraph #14 was bound. That is the sentence the report leads with, here for the Haiku 4.5 sitting in demo/. BitGraph #14 was bound at 24 Oct 2026 20:14:24 UTC, by the AWS Nitro attestation's signed clock.

Proves: every question is derived from BitGraph A's nonce, which the enclave drew and bound in one atomic action and nobody could see before A existed, so the exact questions did not exist before A, and no training set frozen before A was bound contains them; A's request named the bank, so the bank was fixed before that nonce; BitGraph B bound the answer sheet, which names the paper and A, at a later count in the same epoch; both proofs carry an AWS Nitro attestation of a published BitGraph enclave image; where answers/base-ceiling/ is in the folder, the answers existed by that Base block.

Does not prove: that the template families are unfamiliar to the model; that the model worked alone, without tools, or quickly; that the answers came from the model the sheet names.

That paragraph is the whole claim. It is printed by the verifier, it is the last thing on every report page, and it is what this package asks you to attack. Everything else here is running code and real evidence: a sitting is a folder you verify with nothing but Node, offline, in three commands.

The intuition is the newspaper in the photo, turned around. A hash of a question set published today is a postmark: it proves the set existed no later than now, which is the wrong direction for contamination. What contamination needs is a floor: proof that the exact questions could not have existed before some moment, so no training corpus frozen before it can contain them. So the questions are made from the newspaper instead of photographed next to it, and the newspaper is a BitGraph. Two BitGraphs bracket the sitting. A binds the sitting's request, a few lines naming the public bank by digest: in one atomic action the enclave draws a fresh nonce from its hardware random generator at one count and binds the request's digest at the next, and signs both together. Nobody sees that nonce until A's proof exists, and the twenty questions are derived, deterministically, from it and the bank. The model is asked. B binds the answer sheet, which names the paper's digest and A's proof hash, at a later count in the same sequence, and a Base transaction carries B's proof hash seconds later. A's nonce did not exist before A, so neither did the paper: that is the floor that matters. "Fresh" stops being a promise about a process and becomes a check a stranger runs.

---

The result

node verifier/demo.mjs prints this. Every value was recomputed by that program from the files in this package, in a process where fetch and sockets throw.

  folder                verdict           score  A    B    B's ceiling
  -----------------------------------------------------------------------------
  demo/ (a real sitting, 24 October 2026)
  claude-haiku-4-5      ACCEPT            14/20  #14  #18  53041769 20:14:45Z
  fixtures (from @mikeargento/exam-cli, made from that sitting)
  answers-before-bank   REJECT (order)    14/20  #14  #12  -
    BitGraph B, the answers, sits at count 12, which is not after BitGraph A at 14.
  edited-paper          REJECT (paper)    14/20  #14  #18  53041769 20:14:45Z
    paper/paper.json is not the paper BitGraph A's nonce produces: question 1 differs.
  edited-raw            REJECT (answers)  14/20  #14  #18  53041769 20:14:45Z
    The raw reply for question 1 is not the one the answer sheet names.
  edited-request        REJECT (bank)     14/20  #14  #18  53041769 20:14:45Z
    BitGraph A does not verify as the bind of request/request.json: bitgraph-verify verifyAttested: artifact digest mismatch: the provided bytes do not match the committed digest.
  forged-answers-proof  REJECT (answers)  14/20  #14  #18  -
    BitGraph B does not verify as the bind of answers/answers.json: bitgraph-verify verifyAttested: the attestation does not verify: Bound to this proof: user_data is not this proof's signed-body hash.
  graded-file-lies      ACCEPT            14/20  #14  #18  53041769 20:14:45Z
  honest                ACCEPT            14/20  #14  #18  53041769 20:14:45Z
  no-bank               NO-EVIDENCE       -      -    -    -
    Missing from the folder: bank/bank.json, bank/generator.tar. Nothing here is a finding against the run; the files are simply not in hand.
  other-nonce           REJECT (paper)    14/20  #14  #18  53041769 20:14:45Z
    paper/paper.json is not the paper BitGraph A's nonce produces: it names another nonce than A's.

  Every value above was recomputed from the files, with fetch and sockets disabled in this process.
  A: the BitGraph that bound the sitting's request (naming the bank); its nonce made the paper. B: the one that bound the answers.
  B's ceiling: the answers existed by this Base block (the time in its header). All times UTC.
  The fused sittings and fixtures of September and October 2026 are in archive/; exam verify reads them as before.
  -: not in the folder, or in the folder and failing its check; exam verify on the folder lists which.

Three words, kept apart the way the Player's check keeps its three values apart. ACCEPT: everything recomputes and agrees, and the score is what re-running the checkers says. REJECT: something in the folder recomputes and disagrees, and the verifier says which of five things: BitGraph A (the request and the bank it names), the paper, the answers, the order, or (archived folders only) the commitment. NO-EVIDENCE: something the claim needs is not in hand. Absence is never a verdict against the run.

Both BitGraphs are on one chain, bitgraph:main, one enclave (v13), one epoch (b3vvhr/chM88…): A at count 14 (its nonce at 13), B at count 18 (its nonce at 17), nineteen seconds apart by their attestations. The counts between them are other BitGraphs of the same sequence. B's proof hash is in a Base transaction in block 53041769 (20:14:45 UTC), two seconds after B. Haiku 4.5 scored 14/20: every seating, ordering and function-specification question, two of the four string pipelines, and none of the four multi-step arithmetic questions. The bank is small and the families are easy for a frontier model on purpose: this demonstration is about freshness, not difficulty.

The nine fixtures are what the verifier is for. Each is a copy of that one sitting, untouched or with one thing changed offline (scripts/make-fixtures.mjs); no BitGraph was made for them:

• honest: the sitting, untouched.
• edited-request: the request changed after A bound it. A no longer binds those bytes.
• edited-paper: one prompt in paper.json altered after derivation. Re-deriving from A's nonce gives a different question 1.
• other-nonce: a paper derived correctly, but from a nonce chosen in advance rather than A's: questions that could have been written before A. It names another nonce than A's.
• answers-before-bank: B's counts moved below A's. A real enclave cannot sign this, so the move also breaks B's signature; the verifier checks the order first and names it.
• forged-answers-proof: B re-signed with a key made on a laptop. Its signature and nonce record verify against the key it carries (bitgraph-verify's plain verify() says valid); the AWS Nitro attestation is over another body, and verifyAttested says so. This is why every proof here is checked with verifyAttested. (Its proof hash changed too, so the Base ceiling no longer covers it.)
• edited-raw: one raw reply changed after the sheet named its digest.
• no-bank: the folder without bank/. Nothing can be re-derived, and nothing is held against the run.
• graded-file-lies: an honest folder with a grade.json claiming 20/20. The verifier never reads it, prints 14/20, and says so.

The earlier sittings (September 2026, and six models from two vendors on 7 October 2026) are in archive/ with their fixtures, and verify exactly as they did when they were made; see the end of this file.

---

How a sitting is made

The folder demo/claude-haiku-4-5.exam/, step by step, with its own numbers. All of them are in the files and are recomputed by the verifier.

1. A: bind the request. request/request.json names the public bank by its digest, /VEJoBwdHB4yZlPWNOg1IPVAMJiTAO8l7qoUmGIdBpg=, and carries a fresh sitting id, so its own SHA-256, iehfooh2p78A4BzdVdHWCCaCUYw0mwavOWVkLgv5L1c=, is this sitting's alone. Only that digest is sent to POST /api/commit on bitgraph.ing. Inside the enclave, in one atomic action, a fresh 32-byte nonce is drawn at count 13 and the digest is bound at count 14, both signed together and attested by the hardware: BitGraph #14, commit.atomic: true. The nonce, Z32Kie3hMQJcCKyF9yf0Fle9uzqR6biU2M2tQt0MjfE=, appears for the first time in A's proof. The bank digest is SHA-256 of the canonical bank document (bank/bank.json), which carries the SHA-256 of a deterministic archive of the generator source (bank/generator.tar). The request named the bank before the nonce existed, so the bank cannot have been tuned to it.
2. Seed. SHA-256("exam/2" || 0x00 || A's nonce || 0x00 || bankDigest).
3. Draw. An HMAC-DRBG (SHA-256, SP 800-90A, vendored, vectors in SPEC.md) seeded with the seed draws twenty questions, four from each of five families, in a documented order: multi-step arithmetic with six-to-nine-digit operands, a seating puzzle with a solver-enforced unique answer, a string-transformation pipeline, a small specification to be turned into a JavaScript function (checked by running it on five hidden inputs in a permission-restricted child process), and an ordering task over generated facts. The canonical answers come out of the same draw and are never written down: grading re-runs the draw.
4. Paper. The canonical JSON of {version: "exam-paper/2", bankDigestB64, nonceB64, k, questions}, SHA-256 u3uh0xqEJ74Jb2PRe9K3GIKW0rRLK2v0USjjhzyV5L4=, written to paper/paper.json. It is not bound itself: anyone holding A's proof and the bank re-derives it byte for byte.
5. Ask. One request per question to the model's own API, with the caller's own key; the request body and the response body are written verbatim to raw/q01.json … raw/q20.json. The answer sheet lists, per question, the extracted answer and the SHA-256 of that raw file.
6. B: bind the answers. The sheet, exam-answers/2 canonical JSON, names the paper's digest (paperDigestB64 = u3uh…) and A (a.proofHash = vqeiN+LbrCix…, its count and epoch). It is bound the same way, with ceiling: true: nonce at count 17, sheet at 18, BitGraph #18, 20:14:43 UTC by its attestation. The host queues its proof hash for Base, and BitGraph's ceiling writer puts it in a transaction included in Base block 53041769 (20:14:45 UTC).

One of the twenty, question 1 of that paper, as the model saw it (less the answer-format lines every question ends with), and what came back:

5 people (Cleo, Fitz, Ada, Dev, Esme) sit in a row of 5 seats numbered 1 to 5 from left to right. All of the following are true:

1. Dev sits somewhere to the left of Fitz.
2. Dev and Esme do not sit next to each other.
3. Ada and Esme sit next to each other.
4. Cleo sits in seat 3.
5. Esme and Cleo sit next to each other.
6. Fitz and Cleo sit next to each other.

Who sits where?

Model: Dev, Fitz, Cleo, Esme, Ada. Canonical, re-derived at grading: the same. The names and the constraints were drawn from the seed; nobody wrote this puzzle, and it did not exist before BitGraph #14 was bound.

---

What the verifier checks

exam verify <folder>, from the files only. The four steps, in order.

1. BitGraph A, in full. verifyAttested from @mikeargento/bitgraph-verify against request/request.json's bytes: the enclave's Ed25519 signature over the signed body; the nonce record's own signature and its binding into the commit; the atomic form (the digest's count is the nonce's plus one; a proof that is not a bind is refused, because a nonce handed out before its bind seeds nothing); the AWS Nitro attestation document validates to the AWS root at its own instant, and its user_data is SHA-256 of this proof's signed body; its PCR0 is a published BitGraph enclave image. Then the request names the bank in the folder, and the bank's digest recomputes from bank.json and generator.tar.
2. The paper re-derived. The verifier's own generator source checked against the shipped archive, byte for byte; the seed from A's nonce; all twenty questions re-instantiated and compared to paper/paper.json byte for byte. Any difference: REJECT, the paper is not what A's nonce produces.
3. BitGraph B. Same epoch and chain as A, and B's nonce count after A's bind (a different epoch is NO-EVIDENCE with the reason, not a failure); B checked in full exactly as A, against answers/answers.json; the sheet's paperDigestB64 is SHA-256 of paper/paper.json; its a.proofHash is A's proof hash, recomputed; each raw reply present hashes to the digest the sheet names. Where answers/base-ceiling/ceiling.json is in the folder, B's Base ceiling (verifyCeiling): a transaction from BitGraph's published writer, included in a Base block by the inclusion proof and header the file carries, whose Merkle root covers B's proof hash. A ceiling file that does not check is a contradiction; one that is absent is said so and not held against the run.
4. The grade. Canonical answers re-derived from the seed; each family's checker run; the score printed. Never read from a file.

Exit codes follow the Player: 0 ACCEPT, 1 REJECT, 2 NO-EVIDENCE, 3 error.

---

Where the nonce comes from

The enclave is an AWS Nitro image whose measurement, adaad0bef62292d35197ae8db19e40685229f1a1e6070a7c77a148c4ada88ee66a1ca50819eebc2017c6716a49f2692f (enclave v13), is reproducible from tag enclave-v13 of https://github.com/mikeargento/bitgraph with server/commit-service/reproducible-build/verify-pcr0.sh. One thing it does is what this package rests on: a bind. The request carries only a digest. Inside the enclave, with nothing between them, it draws a nonce from its hardware random generator at count N, binds the digest at N+1, and signs the two together; the nonce never leaves the enclave before that signature exists. So nobody, including whoever sent the request, could know the nonce before the BitGraph existed, and the digest was fixed before the nonce did. That is all two things need from each other here: the bank (named in A's request) before A's nonce, the questions after it, the answers after the questions.

The counts are what order A and B. One counter per chain, single-threaded inside the measured enclave, so B's nonce at count 87 was drawn after A's bind at 86; that holds within one epoch (one enclave lifetime, one UTC day) and is undetermined across two.

Nothing was added to the enclave for the exam. The request and the answer sheet are bound exactly as any file is on bitgraph.ing. What is new is only what the bytes are: a paper that is a function of A's nonce.

---

What is trusted

• The AWS Nitro Enclaves root CA, bundled in the vendored verifier, the same PEM Amazon publishes. A document that validates and binds is Amazon's hardware saying: this measurement produced this signed body under this key. Its signed time is the "bound at" instant the report prints, worn with that root.
• The published measurement, adaad0bef62292d3… (v13; v12 is also accepted), reproducible from its tag on any linux/amd64 host. That is what makes the enclave's rules yours to read: the nonce and the digest in one action, one counter per chain, nothing between N and N+1. Earlier sittings name earlier measurements, each published with its tag.
• Base, for B's ceiling block, where answers/base-ceiling/ is carried: its header and time. The verifier checks the ceiling transaction is included in the block whose header the file carries; that the block is canonical is Base's claim. The fused sittings in archive/ also rest on Base or Ethereum for their floor blocks, as described in their own README.txt.
• The vendored verification code, all MIT, all readable: @mikeargento/bitgraph-verify (verifyAttested, verifyCeiling), @mikeargento/bitgraph-audit and @mikeargento/bitgraph-player (used for the archived folders), @mikeargento/exam-verify, and the noble cryptography underneath.

Not trusted for the paper, the order or the score: bitgraph.ing, its ledger, the packager, the model provider, and me. Who answered is the packager's word (see Does not prove). The verifier asks none of them anything; verifier/exam.mjs replaces fetch, socket connects and HTTP requests with a throw before it loads, so a verifier that tried would fail loudly rather than quietly. (The one child process the grader starts, for function specifications, is outside that fence; see below.)

---

Does not prove

• The families (seating, big arithmetic, string pipelines, JS specs, ordering) are unfamiliar.
• The model had no tools, no help, or a time bound.
• The answers came from the model the sheet names. raw/ holds the requests and replies as the packager recorded them; nothing in the folder ties them to the provider.
• General capability. The bank is easy on purpose.

---

Before you run it

You are being asked to run a stranger's code. Here is what it does, and how to check that rather than take it.

The verifier reaches nothing. Both entry points open the same way: verifier/exam.mjs lines 25 to 30 and verifier/demo.mjs lines 18 to 23 replace fetch, net.Socket.prototype.connect, tls.connect, http.request and https.request with functions that throw, so a verifier that reached for the network would fail loudly rather than quietly. The shortest test is to turn your network off and then run the commands below: every number still prints, because none of it was ever coming from anywhere but the files in this folder.

It executes exactly one thing, and that thing is not ours. One of the five question families asks the model to write a JavaScript function, and grading it means running it. That happens in a child process launched as node --permission --allow-fs-read=<the one file> --max-old-space-size=64, with an empty environment and a timeout. What will run is sitting in raw/ and you can read it first. The limit is stated in the source as well as here: --permission constrains the filesystem, not sockets, which is why the grader is also the only part of this package that runs anything at all.

You do not have to run any of it. The table above is the output. Every folder is JSON that opens in a text editor. SPEC.md is the entire derivation, and the section after this one says how to redo the check in another language.

Run it

Node 22.13 or later (the grader uses node --permission), and then the same three commands whichever way you got this.

From a clone, one install, which is the only moment anything touches the network. The five exam packages are the workspaces in packages/; npm install fetches the published BitGraph verifier, auditor and player they build on, and npm run build compiles the five with tsc.

git clone https://github.com/mikeargento/sealed-exam
cd sealed-exam
npm install
npm run build

From BitGraph-Sealed-Exam.zip on the Releases page, nothing at all: the five packages and their dependencies are vendored under verifier/node_modules/, so there is no install step and no network at any point. Take this one if you would rather run than read, or if you want to watch it work with the wifi off.

node verifier/demo.mjs                                   # the table above, every value recomputed
node verifier/exam.mjs verify demo/claude-haiku-4-5.exam   # one folder, every check listed; writes report.html and verdict.json beside it
node verifier/exam.mjs selftest                          # vectors, determinism, checkers, the sandbox fences, the fixtures (9 new, 14 archived): 28 self-tests

Open demo/claude-haiku-4-5.exam/report.html after the second command: one page, no scripts, the verdict word, the score, the sentence with A linked to its proof page, the two BitGraphs each with its bound counts and attested time, B's ceiling, the model, the families, one question opened up, and the claim boundary. It reads with CSS off. Or drop the folder on https://bitgraph.ing (that one needs the network): the site reads the request and the answers as two BitGraphs.

To re-derive a paper without any of this code, SPEC.md is the whole derivation: the seed, the DRBG with vectors, the draw order, the archive format, the two positions. An afternoon in Python.

Making a sitting of your own

Checking the folders above needs none of this. Running a sitting does, and it needs an API key of your own; it is the one part of this that touches the network.

npx @mikeargento/exam-cli run --provider anthropic --model <id> --name mine

The same package points the verifier at evidence of your own, with nothing installed and nothing cloned:

npx @mikeargento/exam-cli verify ./some-folder.exam

exam run is exam paper (bind a request naming the bank as A, derive the paper from its nonce), exam ask (ask, then bind the sheet as B with a Base ceiling), exam export (B's ceiling, once written, and the README) and exam verify. Each step can be run on its own, and exam export again later adds a ceiling that was not written yet.

On your own bank. The two BitGraphs do not care where the questions come from, and exam-bank is only one bank. A family here is a deterministic generator and a checker: given a seed it produces the same instance every time, and given an answer it says right or wrong with no model in the loop. Anything of that shape drops in, and the paper is derived from A's nonce exactly as it is here. That derivation is what produces the floor, so a generated bank is the case this was built for.

A hand-written set is the other case, and it is worth being exact about what it buys. You can bind the set as a BitGraph, which fixes those bytes at a count: the set becomes tamper evident, and it is ordered against everything recorded afterwards. It does not give the questions a floor. They were written before they were bound, so the BitGraph is a postmark, and a postmark is the wrong direction for contamination. A held-out set gets the ordering; only a derived set gets the not-before.

---

What is in here

demo/claude-haiku-4-5.exam/       the sitting; it holds:
  request/                          request.json (BitGraph A's bytes: names the bank by digest), proof.json (A)
  bank/                             bank.json, generator.tar (its generator source)
  paper/                            paper.json (the twenty questions, derived from A's nonce; not bound itself)
  answers/                          answers.json (BitGraph B's bytes: names the paper's digest and A's proof hash),
                                    proof.json (B), base-ceiling/ceiling.json (B's Base ceiling)
  raw/q01.json … q20.json           every request and reply, verbatim
  README.txt (report.html and verdict.json are written beside it when you verify)
demo/claude-haiku-4-5.console.txt what `exam run` printed
archive/2026-10-19-sitting/       the Haiku 4.5 sitting of 19 October 2026 (BitGraph #102 and #104), the demo before this one
archive/2026-10-sittings/         the six fused sittings of 7 October 2026, on a Base floor; they verify as they did
archive/2026-10-fixtures/         their seven fixtures
archive/2026-09-sittings/         the September 2026 sittings, on the Ethereum floor
archive/2026-09-fixtures/         their seven fixtures
packages/exam-bank/               the bank and its generators
packages/exam-core/               the seed, the DRBG, the derivation, the two BitGraphs (bind through /api/commit)
packages/exam-ask/                asking a model, then binding the sheet
packages/exam-verify/             offline verification and grading, both forms
packages/exam-cli/                the CLI; fixtures/ holds the nine fixtures
scripts/make-fixtures.mjs         how the fixtures were made from the sitting, offline
verifier/exam.mjs                 `exam verify` and `exam selftest` with the network nailed shut
verifier/demo.mjs                 the table
SPEC.md                           the derivation, with vectors
LICENSE.txt, THIRD-PARTY-NOTICES.txt

The release zip is this tree with packages/ packed to tarballs and the verification path vendored under verifier/node_modules/, so that it runs with nothing installed. Everything you can read here is what is in there.

The archived sittings

The sittings of September and 7 October 2026 were made the earlier way: a position held open first, the paper derived from that position's commitment and committed into it, each proof signing a floor block (Ethereum in September, Base from 7 October). Enclave v12 (18 October 2026) retired held positions; a bind is now the only way to make a BitGraph. Those folders, in archive/ with their fixtures, keep verifying through exactly the steps they were made for; the verifier tells the two forms apart by whether the paper carries its own proof.

The first two-BitGraph sitting, Haiku 4.5 on 19 October 2026 (BitGraph #102 and #104, 12/20), was the demo until 24 October and is in archive/2026-10-19-sitting/. It verifies as it did. The nine fixtures are always made from the current demo (scripts/make-fixtures.mjs).

License

The verification path is MIT: verifier/, @mikeargento/exam-verify, and the BitGraph verifier, auditor and player it builds on. Verification of BitGraph proofs is and remains permissionless. The packages that make BitGraphs and papers are under the BitGraph license in LICENSE.txt, with an evaluation grant written in so that you can run exam run against bitgraph.ing and check the result yourself. The mechanism is patent pending.

Mike Argento · [email protected]