STAR-TIE-512-v2 protocol - improve testing and fix permutation bias

[kylegrover]

Branching off of my Rust port I noticed the limitations in the testing method and decided to see if Claude could crack it. It tried another testing method which uncovered a potential permutation bias and some other quirks.

I spent some time iterating on this, but it was again largely LLM driven (hashing out plans with gemini 3.1 pro and then delegating to various 'agent' models in copilot) so I'm marking this a draft until I have more time to evaluate it manually and in integrated use in my bot.

here's the LLMs emoji-laden proposed PR message:

feat(v2): stabilize STAR-TIE-512-v2 protocol, fix permutation bias, and finalize documentation

📝 Overview

This PR implements and stabilizes the STAR-TIE-512-v2 protocol across Python, Node.js, and Rust. It resolves a subtle permutation bias discovered in the v1 implementation caused by SHA-512 internal state leakage, enforces strict fixed-width encodings to prevent collision vulnerabilities, and overhauls the test suite to validate uniformity at scale.

🔒 Cryptographic & Algorithmic Fixes

• Fixed Hash State Leakage (The Bias Bug): Shifted away from copying the SHA-512 internal state. The canonical salt is now hashed to a final digest, and each candidate key is computed completely independently as Hash(salt_digest || name_utf8). This guarantees a full cryptographic avalanche effect and eliminates positional bias.
• Enforced Fixed-Width Encodings: Standardized on 8-byte little-endian encoding for all integer scores across all languages. This eliminates variable-length concatenation vulnerabilities and completely seals off collision attacks.
• Mandatory Entropy: Made the 8-byte magic injection explicitly mandatory for adversarial/high-stakes elections to definitively close "poke and hope" determinism attacks.

🧪 Statistical Validation & QA

• New O(N2) Positional Test: Introduced check_positional.py, a highly efficient positional matrix chi-squared test. It successfully proves a uniform, unbiased distribution (balanced Z-scores) for 30+ candidates in milliseconds without hitting the O(N!) factorial memory wall.
• Bias Hunting: Included hunt_bias.py, which successfully isolated the v1 skewed distributions and verified the v2 fixes.

📖 Documentation Overhaul

• Updated the README.md to clearly explain the v2 protocol architecture and the transition from optional to mandatory magic bytes.
• Removed outdated legacy narrative regarding deterministic brute-forcing (now mitigated by v2).
• Corrected the Q&A to accurately reflect the new hash-first behavior (removing references to .copy()) and fixed-width encoding rationale.

📂 What Changed

• permute.py: Updated canonical salt digest + key derivation to v2 strictness.
• permute.js: Ported v2 approach (removed .copy() state path).
• rust/src/lib.rs: Ported v2 approach and updated exact match expectations in tests.
• README.md: Narrative cleanup, math fixes, and accuracy updates.
• hunt_bias.py: Added script for targeted bias tracking and data capture.
• check_positional.py: Added the main O(N2) uniformity test harness.

✅ Verification & Test Suite

All cross-language behaviors and doc tests are passing and deterministic:

• uv run python check_readme.py — PASS
• uv run python check_positional.py — PASS
• uv run python compare_driver.py — PASS
• cargo test --manifest-path rust/Cargo.toml — PASS