The Sealed Witness

Between the file on disk and the digital-to-analog converter on the wire, a great deal can happen to an audio signal, and almost none of it is visible to the listener. The stream can be resampled to a rate the hardware prefers; mixed through the operating system’s audio path; scaled by a volume curve; dithered; re-quantised; or converted between sample formats. Any one of these leaves the audio audibly intact and bit-altered — no longer identical to what the file encoded.

The conventional response is a badge: Bit Perfect, Hi-Res, Lossless. The difficulty is that in almost every player the badge is a static assertion. It is shown because the software reached a state in which the developer decided to show it. It does not inspect the bytes actually travelling to the converter. If a code path silently resamples, or the OS quietly interposes its mixer, the badge does not know and does not change. It reports intent, not reality. For the listener who cares about bit-perfect playback, that is precisely the wrong guarantee — they do not want to be told the signal is untouched; they want it proven. The Sealed Witness is built for that listener: it does not ask to be believed.

The Sealed Witness is a runtime self-attestation of the bit-perfect path. As the Engine plays, it computes running CRC32 checksums at two independent points in the pipeline and compares them. If the audio crossed the Engine untouched, the checksums agree. If anything altered it, they diverge, and the Engine says so. The distinction that matters is this: the resulting verdict is not a value the software chooses to display. It is the result of comparing the actual bytes at the two points. There is no state in which the Engine shows a bit-perfect verdict without the underlying checksums being equal, because “bit-perfect verdict” is defined as their equality. The badge and the measurement are the same object.

The Engine draws a mark at two points. The source tap hashes the decoded stream as it enters the delivery reservoir. The transport tap hashes the stream at the moment of USB submission, after the gain stage. On the bit-perfect path the gain stage is identity, so a healthy stream produces identical checksums at the two taps.

The two checksums are not compared as bare running totals that merely happen to end equal. A ledger records the source checksum at each chunk boundary, tagged with its byte position. The transport side snapshots its checksum at the same byte positions. Verification then correlates the two at a matched byte position — the source checksum for exactly the span of audio the transport tap has hashed — and compares those. The question the Witness answers is not “did two numbers coincide,” but “for this exact span of audio, is the stream at the wire identical to the stream that left the decoder.” The reservoir sits inside the witnessed span, bracketed by the two taps; its round trip is part of what is proven, not an unwitnessed gap. On a seek, both taps reset in lockstep, so the evidence always describes the segment now playing.

The number of checksums that produce a verdict is not fixed — the Witness grows the instrument the signal requires. In the ordinary case — an integer stream in the converter’s native layout — the verdict is a direct comparison of source tap against transport tap: two hashes, one comparison. Where a converter demands a wider container — a 24-bit sample carried in a 32-bit frame — the Engine zero-pads the sample; the file’s bits are preserved and the added bits are null, carrying no signal. The Witness needs no new instrument, because its source tap is taken after the container is formed, so the padding sits inside the witnessed span. Where a mono source plays to a stereo-only converter, the Witness runs a tap per channel — hashing the left and right lanes at the transport tap and checking both carry the single source faithfully, proving not merely preservation but faithful duplication, the full distance to the wire. And where DSD is bit-reversed on the way to the wire, the Witness hashes the source a second way — the same bytes in the wire’s bit order — and tries the wire against that. The pattern is consistent: where a signal is duplicated, the Witness adds a tap; where it is transformed, it adds a hash form to bridge the change; where the container merely widens, it needs nothing new at all.

The comparison yields exactly one of four states, and the Engine shows the one the stream earned:

And how is a verdict chosen, once the two marks are in hand? In the ordinary case, by a single comparison:

# derive(source, wire, volume) — the ordinary case; mono-dupe and DSD vary (§4)

VERIFIED   if   source.crc == wire.crc      # equal, bit for bit — the stream is untouched
ALTERED    elif volume_engaged              # they differ, but by the listener's own hand
MISMATCH   else                              # they differ, with no sanctioned cause

The Witness’s checksums are running accumulations, not independent per-moment snapshots. Each hash folds in every byte of the stream from the last reset onward. Once the two accumulations diverge, they cannot re-converge. Alter the signal by so much as 0.1 dB and the changed bytes are folded permanently into the running transport checksum; from that byte onward the two hashes have parted, and no subsequent stretch of clean audio can bring them back into agreement, short of a CRC32 collision on the order of one in four billion. Returning the volume to unity does not heal it: the later bytes are clean again, but the record of the touch is already inside the accumulation. The only thing that clears the divergence is a fresh play, which resets the Witness. The bell, once rung, stays rung until the track is played again. The scope of this guarantee is the continuous playback segment; a seek or a track change resets the Witness, so it attests the audio now playing — a live, running measurement, not a certificate stamped over a whole session after the fact.

Both taps sit downstream of the file read and the container parse. This places a precise and deliberate boundary on the claim. The Sealed Witness is a consistency witness, not an authenticity one. It proves that the bytes the decoder produced reached the wire unchanged. It does not, by itself, prove that those bytes match the file on disk — a fault upstream of the source tap would be seen identically by both taps, which would agree, and report Verified. Consistency is what the two-tap construction can prove; authenticity against the source file is a separate guarantee, and the Witness does not claim it. This is a chosen scope, not an oversight: the Engine’s verification terminus is the transport handoff, and an unbounded authenticity claim would regress without end — toward the file system, the storage medium, and ultimately the listener’s own ear.

Within its stated scope, the strength of the Witness is not that it checks — many things check — but that it cannot be made to show a positive verdict over an altered signal. This is not a claim to take on trust. It can be read off the shape of the decision itself:

# A verdict exists only where two marks correlate.

wire   = transport.snapshot()          # crc, byte-position, generation — one coherent read
source = ledger.at(wire.generation, wire.position)   # the source mark for the SAME span

if source is None:
    return NO_VERDICT                  # no correlated pair — nothing shown, never green

verdict = derive(source, wire, volume) # pure function of the marks — nothing else reaches it

Count the ways a false positive is foreclosed. A verdict exists only where two marks correlate; where no correlated pair is found, the Engine returns nothing — absence of proof is shown as absence, never dressed as success. The two marks are of the same span, bound by generation and byte position, so no chance agreement between different stretches of audio can be taken for a match. They are drawn from one coherent read, so no torn or stale state can slip a false pair past the comparison. They are taken at two independent points — the transforms under scrutiny share no stage with the apparatus that scrutinises them. And the verdict is a pure function of those marks: no override, no hidden switch, no path by which anything outside them can set the result. Whatever per-class test the marks are put to (§4), a positive verdict is reached only upon their genuine equality — no branch reaches a positive on inequality.

What remains is the thing a rigged instrument never does: the Witness reports against its own interest. It has verdicts that withhold the badge it exists to grant — Altered when the listener would rather see bit-perfect, Unverifiable when it cannot prove the case. A system tuned toward a positive does not volunteer the cases it cannot certify. The existence of the honest negatives is the evidence that the positive is not manufactured.

A claim is only as trustworthy as its stated boundaries. The Witness proves the software path is transparent from the source tap to USB submission — no more. It does not vouch for what the decoder produced before the source tap, nor for what the converter does inside itself after the bytes leave the wire, nor for the operating-system layer below the handoff. The last inch is unwitnessable by design: USB isochronous output has no content acknowledgement; past the submission boundary there is no software readback, and no verdict claims to reach it. The honest statement is bit-perfect to the converter’s doorstep — which the Engine can prove — not bit-perfect to your ears, which no software can. Verified is a bit-exact match subject only to CRC32 collision, and Altered is an inference, not a proof of intent: once the Engine has deliberately touched the signal, it is honest that it can no longer offer the bit-exact guarantee. None of these limits weakens the claim. They are what let it survive scrutiny. The Witness tells the truth about the middle so that you can believe it about the ends.

The Witness invites the audit it is built to withstand. A listener with a known file and a wire-capture instrument can confirm the bytes arriving at the converter against the bytes in the file, and confirm that the verdict the Engine reports matches physical reality. The proof is not asked to be taken on faith. It is offered to be checked.

Bit-perfect playback, in Vox Machina, is not declared. It is measured at the wire, correlated at matched positions, carried in a running seal that no toggle can undo, and reported in a verdict that within its stated scope cannot show a positive over an altered signal — and that is honest enough to withhold the badge when it has not been earned, and to name exactly where its knowledge ends. Verified, not asserted.

Recovered whole. Set down for the page.