Please open a private security advisory on this repository (Security → Report a vulnerability) rather than a public issue.

This file is written by hand rather than generated, because the portfolio's shared template describes certhead incorrectly. The template says "a measure-only tool. It reports; it does not gate, admit, refuse, or modify any system under test." That is true of the other packages here and it is the wrong sentence for this one.

certhead does not report. It computes the identical function. It is an equivalence-preserving rewrite of argmax(W h): it takes a hidden state and returns the token a dense output head would have returned, always, by construction. It admits nothing, refuses nothing, and gates nothing — not because it declines to, but because there is no decision in it. See CLAIMS-MAP.md.

That distinction matters for what counts as a vulnerability here.

• Any input for which argmax_certified returns a token other than dense_argmax. This is the one invariant, it is meant to hold with no tolerance and no seed, and a counterexample is the most serious report this project can receive. Include the weight matrix, the hidden state, and the head configuration.
• A certified interval that does not contain the true score — every pruning decision rests on that containment, so a violation makes the pruning unsound even when the final token happens to match.
• A path that reports proven_by_bound when the bounds did not in fact separate, or attaches a margin to a result established by the dense fallback.
• certhead verify --signoff-cert emitting a certificate whose recorded bound is not supported by its own evidence block, or whose digests do not cover its body.
• Any input that produces a confident exit code (0 or 1) when nothing was actually checked. Exit 2 means not checked, and anything that erodes that meaning is a real defect — five such cases have already been found and fixed.

• Performance. certhead can be slow; that is the explicit trade for never being wrong. A configuration where it reads more bytes than a dense head is a documented and tested outcome (byte_fraction is deliberately not clamped at 1.0), not a vulnerability.
• Resource exhaustion from a caller-supplied head that does not fit in memory. certhead does not allocate on behalf of an untrusted party; the caller owns W.
• Findings that require certhead to be wired into an enforcement path. It has no such path, and that wiring is not part of this package.

certhead performs local numerical computation and probes no remote endpoint.