Q4 Capstone

Hesitator

Q4 capstone: ship a cryptographic component of the Trustless Journalism Protocol into Hesitation Media production with a published threat model.

Unlocks at 9,000 XP
Reward +1200 XP
Submission live in production at memoryhole.media + threat-model document

Scenario

Fifty-two weeks in. Pinter ch 26–28 (field extensions, Galois preview) done, ECC and Ed25519 implemented from scratch, post-quantum awareness built through the Q4 reading. The Q4 capstone is the year's terminal artifact: a cryptographic component of the Trustless Journalism Protocol shipped into Hesitation Media production. The thing the year was for. With it: the threat-model document that makes the cryptographic claims defensible to a hostile reader.

Success criteria

  • One cryptographic component (verifiable archive manifest, anonymous source credential, signed claim provenance, or another design proposed in week 24's spec) shipped to a Memory Hole investigation.
  • End-to-end working: a reader can, with no special tools beyond a browser, verify the cryptographic claim.
  • Threat-model document published alongside: who the assumed adversary is, what they can and cannot do, and which attacks the design is and is not defensible against.
  • An honest section on what the design does not protect against. This is the most important part.
  • Public Hesitation Media announcement post written in the journalism register, not the academic one.

What the artifact might be

The candidate designs from the week-24 spec sketch:

  1. Tamper-evident archive verification. The Q2 archivist CLI extended into a Hesitation Media-wide protocol. Every Memory Hole investigation publishes a Merkle root + manifest. A reader can verify any source file independently. Optional: detached signature with your PGP key.
  2. Anonymous source credential. A source proves they are a credentialed person who saw a document, without revealing who they are. BBS+ signatures or group signatures. Harder to ship correctly; bigger payoff.
  3. Verifiable claim provenance. A journalist signs each paragraph at write-time; the published article carries the signatures. The reader can verify which paragraphs are human-authored vs. AI-assembled. Useful in the post-2025 information environment.

The week-24 spec sketch decides which one. Q3 prototype work refines it. Q4 ships it.

The threat model document

The threat model is the cryptographic claim made legible to a hostile reader. The structure:

  1. Adversary. Who is the assumed attacker? Their capabilities?
  2. Goals. What is the protocol trying to protect? What kind of trust is it asking the reader to invest?
  3. Defended-against attacks. Concrete attack scenarios the design defeats. Worked through.
  4. Not defended against. The hard section. What the design does not protect against. State plainly.
  5. Trust assumptions. What the reader has to take on faith (e.g., “the journalist’s PGP key has not been compromised”).
  6. Quantum future. Whether and how the design degrades when CRQC arrives. What the migration path looks like.

The threat model document is the prose artifact that makes you a cryptography researcher rather than a hobbyist. Take it seriously.

Why this capstone matters

Everything before this was rehearsal. The capstone is the first piece of cryptography you ship under your name with real adversaries in mind. From here forward, the question stops being can you do cryptography and starts being what cryptography are you working on. That is the question that makes the next year a research program rather than a curriculum.