Moving visuals on this page — measured at 0.26% brightness change per frame and zero flashes per second; your reduce motion setting stops them. What moves, and how it was measured
Mathematical plates that draw themselves — prime counts, orbits and lattices rendered live rather than shipped as pictures. It runs continuously while
on screen, and it pauses on its own whenever it scrolls out of view.
We measured it rather than guessing: the largest frame-to-frame change in
average brightness is 0.26%, and it produces
zero flashes per second against the threshold of three set by
WCAG 2.3.1.
That is well under the limit, and it is not a promise about any individual: if
moving images are a problem for you, you should not have to assess ours.
Everything animated on this site honours your system’s
reduce motion setting — turn it on in your operating
system or browser and these pages stop moving, with nothing else lost. All the
mathematics is in the text and the still figures.
Provenance
This page audits itself while you watch.
You can copy this site. Every byte of it is served to your browser and can be saved. The scripts are minified and several are obfuscated, so they are harder to read than we would like; the checks below do not depend on reading them — they compare what the page computes against constants published where we cannot edit them.
What a copy cannot do is make a DOI resolve to it, or a company register list it, or the OEIS agree with it. So instead of defending the pixels, this page checks the things underneath them: four computations run in your own browser, right now, against constants published where we have no ability to edit them.
If one of these ever fails on the real site, it is telling you something true and we would want to know. The failures are shown as plainly as the passes.
Four checks, no assertions
Run the audit
?
Math: a SHA-384 over 524,288 shipped bytes compared against a digest printed in a deposited paper; the Mertens function summed to 100,000 and checked against ten published OEIS values; a full iterated-prisoner’s-dilemma round-robin re-deriving Axelrod & Hamilton’s structural result. Dev: about 200 lines of plain JavaScript, no dependencies, running under a nonce-based CSP that forbids every third-party origin. The hashing is crypto.subtle; everything else is integer arithmetic. Why in the browser: a server telling you it verified itself is a server asking to be trusted. This asks you to trust nothing — the bytes are fetched in your tab and the arithmetic happens on your machine.
Nothing runs until you press the button. It takes about a second, most of which is the 512 KB tablebase.
How the ledgers are kept
A hash chain, tampered with in front of you
Three ledgers on this site — API registrations, bug reports, the factory’s discoveries — are hash-chained: each row stores the hash of the row before it, and its own hash is SHA-256 over a canonical encoding of that previous hash and its fields. Below, a made-up ledger of ten entries is chained with crypto.subtle, then one byte of one entry is edited and the chain recomputed. The edited entry and every entry after it stop matching the stored hashes; the entries before it still verify. That is the whole guarantee: not who edited, but that something was, and from where on — and it binds us as much as anyone else.
The encoding is JSON.stringify([prev, fields…]), not concatenation: with concatenation, text could move between two fields without the hash noticing. Recomputed in the build with an independent SHA-256.
Being precise about it
What this proves, and what it does not
Claim
Does this page establish it?
The chess data here is the data that was deposited
Yes The digest is in a paper with a DOI, which is a record we cannot revise.
The mathematics on this site is real
Yes Two of the checks re-derive published results from scratch in your browser and would fail loudly if the arithmetic were decorative.
This work belongs to KodamaSEC
Externally Not by this page. By Companies House, the ICO register and ORCID, which you can check independently in a minute.
Nobody can copy this site
No Of course they can, and this page will run perfectly well on their copy — because the constants it checks against belong to us, and a copy running it is quoting our references.
A copy would be detectable
Not by us We cannot see someone else’s server. What we can do is make the original checkable, so that anyone comparing the two has something exact to compare.
That last pair of rows is the honest bottom of this page. A site cannot prove it is not being copied. It can be built so that its claims are anchored outside itself, and then the question stops mattering: a copy inherits the pixels and none of the evidence, and the evidence was always the point.
Credits, fonts & licences
Whose work this is built on
Everything third-party here is self-hosted — no CDN, nothing fetched from anyone else’s origin at runtime — so this is where we name who made it and under what licence. If we have used something and credited it poorly, or missed it entirely, that is a mistake we want to fix: tell us at @KodamaSecLabs. The mathematical attributions are gathered on Challenges.
The mathematics itself — the ideas, theorems and prior results these build on — is credited at its point of use and gathered on Challenges, where we also keep a standing, open request for the references we may still be missing. Data sources (the OEIS, LMFDB, IBM Quantum) are named where they are used.
We set no cookies of our own beyond what the site needs to work, and we run no advertising and no cross-site tracking. Our network provider measures page performance at the edge without cookies and without anything we can tie to a person; we get aggregate numbers, never a visitor. It also runs bot protection there, which is a security control and stays.
Cookies & local storage — the exact list, not a summary
Nothing here is hidden behind a settings toggle that doesn't actually do anything: if it's not in this table, we don't set it.
Name
Type
Set by
Purpose
Duration
ksec_theme
localStorage
This site
Remembers your light/dark mode choice
Until you clear it
ksec_cookie_ack_v1
localStorage
This site
Remembers you've seen this notice
Until you clear it
ksec_cookie_choice
localStorage
This site
Remembers whether you accepted or rejected, so we do not ask again
Until you clear it
ksec_build_notice_v1
localStorage
This site
Remembers that you collapsed the build notice in the corner
Until you clear it
ksec_notice_rev_v1
localStorage
This site
The site revision you last loaded, so a page left open across a deploy can tell you it is stale
Until you clear it
ksec_catalog_seen
localStorage
This site
How many entries the shared catalogue had the last time you looked at it, so the nav can tell you when it has grown and stay quiet when it has not. One number. It says nothing about you — only about how much of a public list you have already seen
Until you clear it
ksec_findings_seen
localStorage
This site
The measurements of Life objects this browser has already sent to the shared catalogue, so it does not send the same one twice. A short list of numbers such as p6:d0-0:n14 — period, displacement, population. It describes what the background drew, not you, and it never leaves your browser: what goes to the catalogue is the pattern itself, and the server measures it there
Until you clear it
ksec_notebook
localStorage
This site
The mascot’s research notebook on /mascot: the claims it tested in this browser, the seed, and the verdict, at most 40 entries. Never sent anywhere.
Until you clear it (there is a button on the page)
ksec_last_visit
localStorage
This site
When you were last here, so the mascot can tell you the site was rebuilt while you were away — and stay quiet when it was not. A timestamp, nothing else, and it never leaves your browser
Until you clear it
ksec_tool_uses_…
localStorage
This site
A per-tool daily-use counter for the free tools, one key per tool (a fair-use nudge, not an enforced limit, never sent anywhere) — set only if you actually use one of those tools
Resets daily; until you clear it
__cf_bm and similar
HTTP cookie
Cloudflare, Inc. (our security & CDN provider)
Distinguishes legitimate traffic from automated abuse — the same security gate described in Methodology
Session, typically under 30 minutes
That's the whole list. We don't set analytics, advertising, or tracking cookies of any kind — Accept and Reject in the banner currently do the same thing on this site specifically because there's no non-essential cookie for Reject to actually disable. That's not us dodging the question: under PECR/LSSI-CE, strictly necessary cookies (all we set) are exempt from consent entirely. We show both buttons anyway, and record which one you pressed, because that's the clearer and more honest thing to do even where it isn't strictly required. Full legal detail in Privacy & Cookie Policy.