What H(log A)H Actually Does: The Operator Behind the Trust Certificate

Every other post in this arc leans on a single instrument: a per-step residual kappa_t that we can falsify every tick. This post is for the reader who does not want the metaphor. You want the mechanism. What is the operator inside that residual actually doing, and why is it the right operator?

The short version: the certificate measures the distance between the trust update you executed and the canonical update the law says you should have executed. Three things make that distance honest. Measure in the right coordinate system (log space). Throw away the parts of the state that carry no information (the row/column gauge). Collapse what remains into one non-negative number that is zero only when the step was legal. Those are the three moves in H(log A)H. Take them one at a time.

Move One: Why Log Space

The canonical trust-transfer law is multiplicative, not additive. Trust does not accumulate like a bank balance where you add deposits. It compounds like a geodesic on the positive matrices — the next state A_{t+1} is a geometric blend of the prior state A_t and the incoming evidence R_t, weighted by alpha_t. Geometric blends are clumsy in the raw matrix entries and clean in their logarithms, because the logarithm turns multiplication into addition.

# canonical step, multiplicative form (hard to reason about):
A_{t+1} ~ A_t^(1-alpha_t) * R_t^(alpha_t)     (entrywise, log-geodesic)

# same step in log coordinates (a straight-line interpolation):
log A_{t+1} = (1-alpha_t) log A_t + alpha_t log R_t

In log space the law is a line. That is the whole reason to work there: a legal step is a straight-line interpolation between two points, and "how far off the line are you" is a meaningful, linear question. [0010] of the patent (US 64/092,485) fixes the quotient coordinate as a function of log A, precisely so the certificate can be a difference of logs.

There is a catch, and it is why positivity matters. log A is only defined when every entry of A is strictly positive; a zero entry sends the logarithm to minus infinity and the construction collapses. So before we ever take a log, every entry is held strictly positive by an epsilon floor [0010]. That floor is not a fudge — it is what makes the coordinate system exist at all.

Move Two: Why Centering

Here is the subtle part, and it is the heart of the post. Not every difference between two log-matrices is meaningful — some of it is pure bookkeeping. Rescale the affinity matrix by an arbitrary positive diagonal — A becomes L A C for positive diagonal L and C — and you have changed the numbers without changing the trust structure. This is the gauge. Different normalizations are different gauges of the same underlying state, and the certificate must not react to them.

Watch what a diagonal rescaling does in log space. Multiplying row i by l_i and column j by c_j adds log l_i + log c_j to entry (i,j):

log(L A C)_{ij} = log A_{ij} + log l_i + log c_j
               = log A_{ij} + u_i + v_j           # u = log diag(L), v = log diag(C)

# as a matrix, the gauge term is rank-one-per-side:
log(L A C) = log A + u 1^T + 1 v^T

The gauge enters as u 1^T + 1 v^T — a column-constant offset plus a row-constant offset. To make the certificate gauge-invariant, we need an operator that annihilates exactly those two terms and leaves everything else untouched. That operator is the centering matrix.

H = I - (1/n) 11^T                      # centering matrix [0029]

H subtracts the mean from whatever you apply it to. Sandwiching a matrix as H M H is the double-centered form: it removes both the row means and the column means. Apply it to the gauge term and the gauge vanishes, because a vector of all ones is in the null space of H (H1 = 0):

H (u 1^T + 1 v^T) H = (Hu)(1^T H) + (H1)(v^T H)
                    = (Hu)(0) + (0)(v^T H)
                    = 0

So H(log A)H keeps only the gauge-invariant content of the log-state and discards the row/column offsets entirely. The patent calls this the quotient coordinate [0030]:

Theta([A]) = H (log A) H                # quotient coordinate; kills u 1^T + 1 v^T  [0030]

This is the precise sense in which normalization is gauge, not trust. Any positive diagonal scaling — and Sinkhorn-Knopp's alternating row/column normalization is exactly a sequence of positive diagonal scalings — is annihilated by H(.)H. Under this projection, Sinkhorn-Knopp vanishes. That is not a bug; it is the design. We worked through it elsewhere in this arc: the doubly stochastic projection is a clean, conservative choice of representative inside the gauge class, but it carries no trust by itself. The causal update — the thing that actually moves the trust state — is the geometric interpolation governed by alpha_t, evaluated in the quotient coordinate. Treating the normalization as the trust dynamic gets the architecture backwards.

Move Three: Why the Frobenius Norm

Now the canonical step is trivial to state in coordinates. Apply Theta to the multiplicative law and the geometry survives the projection unchanged, because H(.)H is linear:

# canonical step in coordinates:
Theta([A_{t+1}]) = (1-alpha_t) Theta([A_t]) + alpha_t Theta([R_t])   [0049]

A legal step is a straight line between two points in the quotient coordinate. So the certificate is the obvious thing: take the residual of the executed step against that line, project out the gauge, and measure its size. The size of a matrix that is zero exactly when the matrix is zero is the Frobenius norm — the square root of the sum of squared entries.

# certificate:
kappa_t = || H( log A_{t+1} - (1-alpha_t)log A_t - alpha_t log R_t ) H ||_F   [0011]

kappa_t is a single non-negative scalar. It is zero if and only if the centered residual is the zero matrix — that is, if and only if the executed step landed exactly on the canonical line, up to gauge. Any departure from the law that is not a relabeling of the gauge produces a positive kappa_t. The norm cannot be argued with. It is not a story the system tells about itself. It is a measurement [0011], [0031].

A Walk-Through Small Enough To Follow By Hand

Take a 2x2 affinity matrix and an arbitrary positive diagonal gauge.

A = [[2, 1],          L = diag(3, 1)        C = diag(1, 2)
     [1, 4]]

L A C = [[3*2*1, 3*1*2],   = [[6, 6],
         [1*1*1, 1*4*2]]      [1, 8]]

A and L A C are different matrices of numbers. They are the same trust state in two gauges. A certificate that reacted to the difference between them would be measuring bookkeeping, not trust. Watch it not react.

In log space the gauge is additive: log(L A C) = log A + u 1^T + 1 v^T, with u = (log 3, log 1) = (1.099, 0) and v = (log 1, log 2) = (0, 0.693). Apply H = I - (1/2)11^T = [[0.5, -0.5], [-0.5, 0.5]] on both sides. Because H removes row and column means, the entire u 1^T + 1 v^T term is mean-subtracted out of existence:

H (log A) H        = some 2x2 matrix M
H (log(L A C)) H   = M + H(u 1^T + 1 v^T)H
                   = M + 0
                   = M           # gauge gone; same quotient coordinate

So Theta([A]) = Theta([L A C]). Both gauges map to the identical point. If we run the certificate on a step taken in either gauge, kappa_t comes out identical — the gauge has no effect on the residual. That is gauge invariance, demonstrated on numbers you can check.

Now perturb the actual step off the geodesic. Suppose the executed A_{t+1} is not the geometric blend the law demands — say a build regression quietly swapped the multiplicative update for an arithmetic average of the entries. Plug the executed log A_{t+1} into the residual:

residual = log A_{t+1} - (1-alpha_t)log A_t - alpha_t log R_t

An arithmetic average does not equal the log-linear blend, so this residual is a genuine matrix — not a row/column offset. H(.)H does not kill it, because it is not gauge. The Frobenius norm turns up positive: kappa_t > 0 on the first interior step, before any dashboard looks wrong. The operator caught a structural departure that the raw numbers concealed. That is the entire job.

Two Honest Caveats (The Truthfulness Boundary)

This is the value certificate, and an honest primer states where it stops.

Endpoints. When alpha_t sits at an endpoint — alpha_t = 0 (ignore the evidence) or alpha_t = 1 (overwrite with the evidence) — the value residual can be uninformative [0016], [0064]–[0066]. At alpha_t = 1 the law says "become R_t," and any executed step that lands on R_t reads kappa_t = 0 regardless of the prior state. A near-zero kappa_t at an endpoint does not certify the endpoint value; it only certifies the monitored interpolation condition. Endpoint values need separate structural verification — the job of the certificate-not-explanation posture, where the realized transition is graded as a causation packet rather than read off a score. The pinned-zero / support-strata case — entries that are genuinely structurally zero rather than epsilon-clamped — is a known hard edge this operator does not claim to have solved.

Finite precision. In real arithmetic kappa_t is never bit-exactly zero even for a legal step, because logs, products, and the projection all carry rounding error. So you never compare kappa_hat_t against zero, and never against a universal magic constant. You compare it against a calibrated per-platform floor floor_t [0055]–[0059], measured on that hardware, that number format, that matrix size. There is no universal kappa_t < 1e-9 — the floor is whatever the platform's noise is, and a step is "legal" when the residual sits within its own platform's floor. Below the floor certifies the monitored condition held; it does not certify convergence, and it does not certify the endpoint values.

These caveats do not weaken the instrument. They define its edges, which is what makes it a certificate rather than a vibe.

Why This Is The Right Operator

H(log A)H is not an arbitrary stack of transforms. Each move is forced by what trust actually is:

• Log because the law is multiplicative; the epsilon floor exists so the log is defined at all.
• Center on both sides because the row/column gauge u 1^T + 1 v^T is pure normalization carrying no trust, and H(.)H annihilates exactly that and nothing else.
• Frobenius because we need one non-negative scalar that is zero only when the centered residual is zero — a single number you can threshold against floor_t and falsify every tick.

The full operator and the certificate it produces are implemented in ccf-core on crates.io. The claim structure — log-quotient coordinate, centering, Frobenius certificate, and the endpoint/finite-precision boundary — is laid out in /patent.

— Colm Byrne, Founder — Flout Labs, Galway, Ireland

Patent pending — US Provisional 64/092,485 (filed June 17, 2026).

FAQ

So kappa_t = 0 means everything is fine?

No — and this is the misreading to kill first. A kappa_t within the floor certifies that this one step obeyed the monitored interpolation law, up to gauge. It does not certify that the system has converged, that the trust value is correct, or that the endpoint values are safe. At an endpoint (alpha_t of 0 or 1) the value residual can be uninformative entirely [0016], [0064]–[0066]. And in finite precision you are comparing against a calibrated floor_t, not against true zero [0055]–[0059]. "Within floor" means "the law held on this interior step," not "everything is fine."

Why does Sinkhorn-Knopp disappear under H(.)H? Isn't doubly-stochastic the trust mechanism?

It is not. Sinkhorn-Knopp normalizes a matrix by alternating positive diagonal row/column scalings. Every such scaling is a gauge term u 1^T + 1 v^T in log space, and H(.)H annihilates it exactly. So the entire Sinkhorn projection vanishes from the quotient coordinate. That is the point: normalization is a choice of representative inside a gauge class, not the thing that moves trust. The causal trust update is the alpha_t-weighted log-geodesic interpolation. We unpack that distinction in the normalization is not the trust.

What is the gauge, concretely?

The gauge is any positive diagonal rescaling A -> L A C. It changes the raw entries of the affinity matrix without changing which trust state they represent. In log space it shows up as a row-constant offset plus a column-constant offset, u 1^T + 1 v^T. Two matrices that differ only by a gauge map to the same point under Theta = H(log A)H, so the certificate reads them as identical — which is correct, because they are the same state in different bookkeeping.

Why the Frobenius norm specifically, not the spectral norm or a trace?

We need a norm that is zero only when the centered residual is exactly zero, so the certificate is faithful: positive iff the step departed from the law (beyond gauge). Frobenius — root-sum-of-squares of the entries — has that property, is cheap on small matrices, and is differentiable, which matters for calibrating floor_t. The choice is about getting one honest non-negative scalar, not about any spectral interpretation.

Is this the same kappa_t from the other posts in the arc?

Yes. kappa_t is defined once and reused everywhere. Trust you can falsify introduces it as the per-step lie detector; the certificate-not-explanation post shows how the realized transition is graded as a causation packet at decision points. This post opens the operator and shows the three moves — log, center, Frobenius — that make kappa_t mean what it claims.