Certificates

It signs the choice, not just the answer.

Factoring an integer produces a number anyone can check by multiplying. An MMPF certificate exists for the part nobody can check by multiplying: which route was taken, against which machine, and what it was predicted to cost.

What a certificate records

The integer and the factors found.
The mode, and the route the selector chose.
The machine profile the prediction was made against.
The predicted cost and the measured runtime.
For assurance mode, the conformal upper bound that drove the choice.
A release binding — a SHA-256 tying the certificate to the code that issued it.

bash

mmpf factor 1000036000099 \
  --mode assurance \
  --machine-profile machine/current_machine.json \
  --output assurance-cert.json

mmpf verify assurance-cert.json

Verification returns valid and release_binding_ok separately, because they answer different questions: whether the certificate is internally consistent, and whether it came from this build.

Ledgers

The interesting artifacts are not the certificates on their own but the four MMLF ledgers, because those can be executed by a runtime with no stake in the result.

Ledger	Transactions	Official replay
`mmpf_bandit_decisions`	600	PASS
`mmpf_conformal_assurance`	180	PASS
`mmpf_policy_voi`	120	PASS
`mmpf_factorization_reconstruction`	2	PASS
Total	902

The last one is the smallest and the most direct: it reconstructs the source integer from the factors as a two-step arithmetic chain, so the factorization claim itself becomes an auditable ledger rather than an assertion.

What a valid certificate does not establish

A valid certificatea claim that the selected route was optimal
A recorded predicted costa bound on the actual cost
A release bindingan identity — it says which build, not who ran it
A signaturea proof that the machine profile describes the machine that ran it