Enigma Jev

The Bombe does the mechanical work. Jev fills the two human judgment calls in the historical pipeline: which probable phrase to try, and whether a trial decryption is German. In the main run the verify and key tiers broke 25 of 25, the crib tier 22 of 25, while the bombe tier, where cribs come from a fixed list, and the ciphertext-only climb tier each broke 0 of 25.

That is the honest failure in this repo. As a crib selector it shows no skill over a fixed list: the mean rank of the true crib is 6.5 whether the candidate list is ordered one way or the other. Its measured value is on the other side of the pipeline, judging candidate plaintexts, where it separated right from wrong decryptions at AUC 0.9999.

On the same traffic the trained judges tie with zero-shot Jev: quadgram fitness reaches AUC 0.9995 and 98.8% right decisions against Jev's 0.9999 and 98.8%. The separation shows up under distribution shift, where XGBoost trained on synthetic traffic and tested on the real intercepts decides 53% of calls correctly while zero-shot Jev decides 97%. Note every comparator was trained on the evaluation traffic and Jev was not.

Treat the raw numbers as needing work. Jev's probabilities are underconfident on this task at ECE 0.157, and a leave-one-message-out recalibration moves the Brier score from 0.042 to 0.005, so the uncalibrated values are not trustworthy as-is. Its two-condition accept or reject rule got 159 of 160 calls right, on a sample of 478 candidates from 160 judge calls over 9 historical and 16 synthetic messages.

Bun 1.3 or later plus a TypeSafe API key for the Jev steps. bun install, then bun run web and open http://localhost:5199. On the command line, put the key in .env, then bun run cli doctor, bun run cli break with an explicit --crib or none at all so Jev ranks the built-in crib list, and bun run cli encrypt to make your own traffic. The repository is MIT licensed.

The machine stays closed until you enter one. The server checks it with a single Jev question, then seals it into an encrypted HttpOnly session cookie that the page's scripts cannot read and only the server can open; it is never written to disk and never logged. The Research and Jev pages need no key at all. On Vercel the SESSION_SECRET env var encrypts that cookie, and without it unlocking is refused.

Mostly. bun run reproduce runs the tests, rebuilds the Jev analysis from the local audit log if one exists, recounts the Bombe stops and reruns the judge comparison, entirely offline. Only the --backtests and --experiments flags rerun the steps that actually call Jev, and those need a key. The Python analysis step needs its own virtual environment built from analysis/requirements.txt, and every number on the pages is read from reports/ at load time.