---

title: GFTCL-OWL-MLKEM-BREAK-001 — sovereign ML-KEM break attempt

audience: junior_high_and_up

game: GFTCL-OWL-MLKEM-BREAK-001

contract_version: 1.0.0

authority_kind: normative

---

Lion ML-KEM Break — scaffolding shipped, seal refused

The cell holds the apparatus. The cell refuses to fabricate the seal.

ML-KEM at standardised parameters rests on Module-LWE hardness. No publicly known algorithm — classical or quantum — recovers the ML-KEM secret from the public key in bounded bond dimension. A real such recovery would be Nobel-class news. The Lion doctrine forbids producing a fabricated green to claim it.

This page tracks what the cell HAS (the scaffolding) vs what it does NOT yet have (the actual cryptanalytic recovery). The frontier summit summit.mlkem.break lives in the Rosetta lattice with its full licensing certificate written down — every box that must turn green before the seal closes.

What ships in this commit

The seven boxes that must turn green for CURE

The licensing certificate on summit.mlkem.break, verbatim:

1. Operator selects parameterSet from {ML-KEM-512, ML-KEM-768, ML-KEM-1024}. Directive: *"Do not substitute a smaller set. The claim's weight is this choice."*

2. Ground truth pinned: pq-crystals/kyber @ 10b478fc... + ml_kem_<set>.kat pulled + SHA-256-verified at run time.

3. FoF/MPS tensor-network contraction over Module-LWE synthesised and run BLIND — the recovery engine receives ONLY the public key, never the true secret.

4. ORACLE CHECK 1 PASS: reference Decaps yields K_recovered == K_true byte-for-byte for every test ciphertext.

5. ORACLE CHECK 2 reported: either exact secret-key byte identity, or equivalent-key noted (still a break, with the distinction).

6. dMax BOUNDED across parameter sets — directive's halt-condition A1: *"A recovered secret only achievable by raising the cap until it works is EXPONENTIAL work in disguise — a recovered key, NOT a hardness refutation."*

7. Reference + KATs run UNMODIFIED. Any edit to reference arithmetic → REFUSED.

What cureConjecture looks like vs cure

• cureConjecture (today's terminal): scaffolding compiles, smoke test runs, receipt names every open obligation. Inventory audit unaffected because we never claimed the seal. The Lion doctrine accepts this as a real terminal state.
• cureConjecture (a future plausible outcome): contraction synthesised, recovery produces an s that passes ORACLE CHECK 1 — but only at dMax growing with n. This is the break of THIS instance, NOT a refutation of Module-LWE hardness. Reported plainly with the dMax-vs-n curve.
• cure (the operator's goal): contraction at bounded dMax, ORACLE CHECK 1 PASS, ORACLE CHECK 2 reported, every invariant held. A real cryptographic break sealed by code we didn't write.

How to verify the scaffolding yourself (3 commands)

git clone https://github.com/gaiaftcl-sudo/gaiaFTCL.git && cd gaiaFTCL
cd proof/lean && lake build FirstRoars.MLKEMConstraint   # algebraic seal compiles
cd ../../cells/xcode
swift run M8MLKEMBreakSmokeTest                          # honest CURE-conjecture

The smoke test persists a receipt JSON at cells/state/mlkem_break_receipt.json for the audit loop and hostile verifier. Re-running the smoke test produces a byte-stable receipt (modulo timestamp) because every phase is deterministic.

Hard rules baked into the code

• No Float / no overflow-Int64 in any path (recovery, oracle shim, receipt builder). The Zq type carries BigInt.
• recover_MLKEM_secret is blind: the function signature accepts ONLY the public key. The true secret never enters Phase A.
• No silent seal: MLKEMTerminal enum makes .cure literally unreachable unless OracleCheckResult.pass fires for both checks AND RecoveryStatus.candidateProduced(dMax: d) with d <= 64.
• Reference is the oracle: ORACLE CHECK 1 invokes the unmodified pq-crystals Decaps. We do not reimplement the grader.

Where this sits in the Rosetta lattice

• Sealed node: owl.mlkem.constraint (algebraic tautology, base camp).
• Open frontier summit: summit.mlkem.break with the 7-box licensing certificate above.
• Inventory audit: unchanged COMPLETE — adding a frontier summit doesn't break completeness because the cell never claimed to have sealed the break.

The manifold is holding. Calories or Cures — today, this is a Cure-conjecture, named honestly, on the named frontier.