Web extra · not in the printed book · Part VI territory

Noise to Everyone Else

Picture four little constellations of dots — one per letter — spelling GIGI in your own frame, then imagine each constellation independently spun and shifted in 3D before it hits the wire, the way you might tumble a handful of pebbles in a jar. On the left: your frame, key in hand — the tumblings undo and the fibers read GIGI. On the right: the wire — the same bytes every eavesdropper gets, each letter still wearing its rotation-and-shift (the SO(3) gauge — a private, per-letter reorientation in 3D). Advance the ratchet (roll every letter to a fresh gauge, one full round of re-scrambling on the wire) and the wire re-tumbles; revoke your key and watch letters go dark in your own view — forward secrecy (once a round is past, no future key can walk backward into it) isn't a permission bit here, it's geometry you can no longer undo. And through all of it, the verifier's invariants never flinch.

your frame — key at epoch 0
the wire — what everyone else sees
same 4 point-clouds in both panes · left = gauges you can undo, undone · right = fully composed
drag to orbit · wheel to zoom

The four letters above live in GIGI as four little bundles — one point-cloud per letter, four in total, spelling GIGI in dots. Each letter carries the same handful of fields: letter (which glyph — G, I, G, I), points (the raw dot positions in the letter's own frame), epoch (which round of scrambling this cloud is currently wearing), claimed_sum_d2 (the pairwise-distance fingerprint stamped at sealing time), and color (just so your eye can tell G #1 from G #3).

Because GIGI is a fiber-bundle database, the scrambling isn't a lock bolted on top — it's a rotation-and-shift the fiber is literally wearing, and it rides along with every read. That's why Carol's clipboard below can verify each letter without ever holding a key: the fingerprint she recomputes on the wire cloud has to match the one stamped at sealing, because the scrambling can't stretch distances — only tumble them.

Carol's clipboard — invariants recomputed on the WIRE cloud, no key involved

per-letter pairwise-distance tuple, claimed at sealing time vs recomputed on the scrambled bytes · gauges are isometries, so these agree at every epoch — that's what lets her verify without reading

The part worth sitting with: after you hit revoke, the left pane is not "access denied" — it is the honest best anyone can do with the old key, which is to undo the gauges up to the revocation epoch and stare at the composition of everything after. There is no server deciding to withhold the letters; the letters are simply no longer anywhere in the old frame. That's the one-way tumbling chain — the RG-flow ratchet, a sequence of rotate-and-shifts you can compose forward but not undo without every key along the way — of Chapter 15, and the reason the book calls the chapter "The Geometry Is the Encryption" rather than "The Geometry Helps".

Peek at a live bundle’s geometry via the public read-only engine

The gauge modes live behind the gauge feature; the invariant-tuple verify path is Chapter 16's VerifyResult. The public read-only instance will happily show you a live bundle's geometry riding along.

—