"Free is a claim about a service. Zero-cost is a claim about a stack. What I learned about verification from being the failure case."
tags: opensource, security, discuss, showdev
author: Nnamdi Michael Okpala (OBINexus)
series: NSIGII Trident
by Nnamdi Michael Okpala — OBINexus
This morning I had cereal and no milk.
I am not telling you that so you feel something. I am telling you because it is a test condition. A protocol is a set of promises about what happens when you need it. You find out whether those promises are real at the moment you actually need them — not in the documentation, not in the demo, not in the funding round. Most infrastructure is never tested by the people it claims to serve, because those people are filtered out long before they reach the part that works.
I am 25 years old, I am a care leaver, and I am in temporary accommodation. That means I have spent several years reaching the part that does not work. That is not a complaint. It is a qualification. When hunger hits the belly, the protocol becomes real — and everything that was theory before that moment either holds or it doesn't.
Free is a lie about accounting
Gmail is free. Everybody knows this.
To use Gmail you need the internet. The internet is not free. You pay for the broadband contract, you pay for the handset, you pay for the electricity that runs both. Google did not make email free. Google made email free to charge for, on a road that somebody already made you pay to walk on.
So when someone says a service costs nothing, ask them: nothing at which layer?
I break it into four. The gate is what you pay to get in — the connection fee, the device, the deposit, the electricity. The toll is what you pay in data — your history, your diagnosis, your correspondence, your movements. The trap is what you pay in attention — the interface engineered so you come back. The theft is what you pay in opportunity — everything you would have built with the hours it took.
"Free" is a claim about one line item. Zero-cost is a claim about the whole stack.
That distinction is not academic and it is not new to anyone who has been poor. It is the exact difference between being told help exists and being able to reach it.
The duty that expires
Here is one that took me a long time to see clearly.
Under the Children Act 1989, a local authority owes duties to a former relevant child. Those duties are real, they are written down, and they end at 25.
Read that as an engineer. The support was never free. It was metered, and the meter was denominated in years. I have been drawing down a quota since I was a child and the balance is nearly gone — not because my need changed, but because the counter did. Nobody described it as a quota, because describing it that way would have made the extraction visible.
That is what I mean when I say the cost is hidden rather than eliminated. Every "free" service I have been offered turned out to have a meter on it somewhere: an age, a postcode, a referral, a form, a phone call I needed credit to make.
Why I built a file format
People ask why someone in my situation is writing a binary artifact format instead of doing something practical. The honest answer is that they are the same activity.
I have watched systems verify the wrong thing and report success. A council checks that a form was submitted, not that a person was housed. The form passes. The process completes. Somebody writes "resolved" in a field. Nothing arrived. Nobody lied — the system verified exactly what it was built to verify, which was not the thing that mattered.
So when I designed .nsigii, the artifact format underneath my toolchain, I built it around one question: what exactly are you checking, and is it the thing you think it is?
An .nsigii file has a header, a manifest, and a payload. The manifest declares what the file exports and — this is the important part — where in the payload each thing lives. The payload is sealed with SHA-256, so if you change a byte of code the file is rejected.
That check is real. It is also not enough, and finding out why is the most useful thing I did this year.
Because the hash covers the payload. It does not cover the manifest. Which means you can leave every byte of code untouched and simply rewrite the address — change one number saying where a function starts — and the integrity check still passes. It passes because the bytes really are the published bytes. Then the caller executes a different function than the one that was signed, gets a plausible answer, and reports success.
I built the attack to prove it. An entitlement check that should return "refused" returns "approved" instead, while the thing it was supposed to block is running. Nothing crashes. Nothing logs. A silent wrong answer, delivered with confidence.
You know that feeling. Everyone who has been failed by an institution knows that feeling. The letter arrives saying your case was assessed and the outcome was reached correctly, and you are still where you were.
The fix is to seal the map as well as the territory — one digest over the manifest and the payload, so the address cannot be moved between the moment a thing is issued and the moment it is checked. Two lines of the doctrine, one line of code.
What it proves, and what it does not
I am not going to overclaim this, because overclaiming is the thing I am against.
Verifying an .nsigii grant proves the grant is authentic and unaltered, and that the cost declared to the individual is zero. It does not produce housing. It does not produce food. The commons has to actually hold the stock — real buildings, real budgets. No amount of cryptography conjures a flat.
There are two more places I keep myself honest. The entitlement proof in the current build is an HMAC, standing in for a zero-knowledge layer — it is not yet a real zero-knowledge proof, and I will not call it one until it is. And every purchase in the demo is simulated by construction, marked as simulated in the artifact itself, because a system built to detect false claims has no business making them.
What the verification does do is refuse to lie. My audit fails a grant where the settlement is zero — where nobody paid anything at all. A cost of zero everywhere is not a zero-cost system; it is a system that has hidden where the cost went. Real money has to move. It just must not move from the person at the door.
The commons provides. The protocol proves. Neither is sufficient alone.
Not charity
The stereotype about people like me — neurodivergent, care-experienced, hungry — is that we can only think about the next meal. That we cannot hold an abstraction because the belly is loud. I have had that assumption applied to me in rooms where decisions about my life were being made.
It is backwards. I noticed the gap in the format because I have been the failure case. I know what it looks like when a system verifies a process instead of an outcome, because I have been the outcome it forgot to check. That is not despite the hunger. That is domain expertise, acquired the expensive way.
So: I still need milk. That is true and I am not embarrassed by it.
And the protocol is still correct. That is also true, and it stays correct at 4am with nothing in the cupboard, which is the only real test any of this ever gets.
This is not charity. This is not subsidy.
This is architecture.
The implementation, the attack, and the test suite are in the nsigii-polycall repository. The technical walkthrough is a separate post — this one is the argument.
https://www.youtube.com/watch?v=qcJJnWmh7DU
https://github.com/obinexus/legal/blob/main/public/articles/OBINexus_Constitution_Article_VIII_Zero_Cost_Doctrine.txt
https://github.com/obinexus/nsigii-polycall-verfication
Top comments (0)