Make privacy a number you cannot accidentally overspend
one move: account the privacy loss
Open the code pane immediately, then use the Spec tab, optional design question, tests, and artifact when you want them.
Finish each move before carrying the artifact forward.
Differential privacy composes: every release spends part of a declared epsilon budget, so an analysis needs a ledger before it queries data.
Deliverable: State the invariant in one sentence.Accept queries while their epsilon costs fit the budget and return accepted names, rejected names, and remaining budget.
Deliverable: Type the smallest deterministic implementation.The ledger never overspends, preserves query order, and reports an empty or exhausted budget explicitly.
Deliverable: Record a normal case and a boundary case.Split one budget across three queries, exceed it with an adaptive query, and compare utility versus privacy.
Deliverable: Name the failure signal and the guard you would add.A privacy ledger with unit of privacy, epsilon budget, and release policy.
Deliverable: Save the contract, evidence, and handoff note.The ledger never overspends, preserves query order, and reports an empty or exhausted budget explicitly.
Split one budget across three queries, exceed it with an adaptive query, and compare utility versus privacy.
A privacy ledger with unit of privacy, epsilon budget, and release policy.
Deriva-authored extension beyond the supplied PDF. The five moves are Deriva’s implementation contract for this project.