# Methodology

How this project attacks K4. Read in conjunction with `docs/orchestration.md`.

## Architectural Principles

1. **Cribs are the oracle, not the agent's judgment.** The crib validator
   (`core/cribs.py::validates`) is a separate, testable function. Agents
   propose; the validator disposes.
2. **No reinventing the wheel.** Before any attack family is attempted, the
   Research Agent confirms it hasn't been exhausted in the public literature,
   and *why* prior attempts failed.
3. **English plausibility is necessary but never sufficient.** False
   positives that produce English-looking text on non-crib regions are the
   historic failure mode of K4 cryptanalysis.
4. **Every candidate has full provenance.** Cipher family, parameters, key
   derivation, transformation order. Reproducible from the spec alone.
5. **Skepticism over enthusiasm.** A "solved" claim requires four independent
   verifications: crib match, statistical plausibility above threshold,
   Devil's Advocate review, and independent re-derivation.
6. **Stand on shoulders.** Bootstrap from existing public Kryptos research
   repos and credit them. Do not duplicate work that's already been done
   correctly.

## Four Verification Gates

A candidate is "verified" only when ALL FOUR gates have been passed:

1. **Crib gate:** `cribs.validates(candidate).passes` returns True
2. **Statistical gate:** `quadgram_score_per_char(non_crib_positions)` exceeds
   threshold T (recommended initial T = -10.0; calibrate against K1/K2)
3. **Red-team gate:** Devil's Advocate report verdict is "Promote to verified"
4. **Re-derivation gate:** A different agent re-implements the method from the
   spec alone and produces the same plaintext

## Attack Family Priority Queue

The orchestrator pulls from this queue, top to bottom, skipping families that
`prior_work.md` documents as exhausted.

### Phase 2A — Composite ciphers
Sanborn used Vigenère for K1/K2 and transposition for K3. K4 is plausibly a
composition.

- **Columnar transposition then Vigenère** (KRYPTOS alphabet, key length 7-14)
- **Vigenère then columnar transposition** (reverse order)
- **Disrupted columnar transposition variants**

### Phase 2B — Berlin Clock keystream
Sanborn confirmed the Mengenlehreuhr is involved.

- Map clock lamp states (5+5+11+4 = 24 lamps) to key letters
- Sweep clock states across relevant date/time seeds:
  - November 9, 1989 (Berlin Wall fall)
  - November 3, 1990 (Kryptos dedication)
  - Specific times in 1990 if documented
- Test as Vigenère key, as one-time-pad, and as transposition route key

### Phase 2C — Hill cipher variants
The "extra L" in the right-side tableau spells HILL when read vertically. May
be a hint.

- 2×2 matrices over the keyed alphabet
- 3×3 matrices
- Test with crib positions to constrain matrix entries

### Phase 2D — Gromark and variants
Per Bean's Histocrypt 2021 work.

- Continue Bean's Gromark primer search with extended primer lengths
- Test Gromark with KRYPTOS-keyed plain alphabet (Bean used standard A-Z)

### Phase 2E — Position-dependent ciphers
The cipher might change algorithm mid-message.

- Algorithm change at position 21 (where EAST starts)
- Algorithm change at position 34 (where NORTHEAST ends)
- Algorithm change at the K3/K4 boundary as evidenced by the OBKR overlap

### Phase 2F — K2-keyed K4
"Layer two" at the end of K2 may be a literal instruction.

- Use K2 plaintext as a running key for K4
- Use K2 ciphertext as a running key for K4
- Use the coordinates from K2 plaintext (38°57′6.5″N, 77°8′44″W) as a
  numerical key

### Phase 2G — Antipodes-derived
Sanborn's Antipodes sculpture (1997) repeats K4 ciphertext with extra
characters.

- Use the Antipodes additions as a key source
- Use the Cyrillic Projector text as a key source

### Phase 2H — XOR-layered approaches
Per the 2022 "German Guesser" work that Sanborn reportedly said "started to
look right."

- XOR of K4 with various candidate keystreams
- Affine cipher layers (a*x + b mod 26)

### Phase 2I — Things we haven't thought of
The Synthesis Agent's job is to propose Phase 2I+ entries based on
cross-domain patterns no one has noticed before.

## When to Stop a Family

A family is "exhausted" when:
- Its full plausible parameter space has been swept (with logging)
- No candidate passed even the crib gate
- The Statistical Cryptanalyst has confirmed the residual structure rules out
  this family

When stopped, the Knowledge Curator updates `prior_work.md` with the
parameter range tested and the negative result.

## When to Stop the Project

The project is complete when one of:
1. A candidate passes all four verification gates
2. Sanborn's solution is publicly released and we can verify our findings
   against it
3. The orchestrator and human user agree that the search space has been
   meaningfully exhausted (a high bar)

Outcome 2 is the most likely. Don't be precious about it.

## Not Targeted: K5

Sanborn confirmed K5 exists and is revealed only after K4 is solved. This
project does not target K5 directly. However, any successful K4 method should
be examined for hints about K5's structure. The Knowledge Curator maintains
`knowledge_base/k5_speculation.md` for relevant findings.