IPPM Working Group L. Melegassi Internet-Draft Catellix Intended status: Informational 6 July 2026 Expires: 7 January 2027 Empirical Lead-Time Profile for Multi-Vantage Path Synchrony (MVPS): The T_LT Profile draft-melegassi-ippm-mvps-coherence-leadtime-01 Abstract This document specifies the Lead-Time Profile for the Multi-Vantage Path Synchrony (MVPS) framework [I-D.melegassi-ippm-mvps-bundle]. It states two LEMMAS (L_LT.1, L_LT.2) that bound what is mathematically provable about lead-time and prescribes a reproducible measurement methodology for evaluating, on a given operational data set, the degree to which the multi-vantage Mahalanobis statistic D^2 raises alarm earlier than a conventional single-vantage scalar test (e.g., z-score on Round-Trip-Time) computed on the SAME underlying observations. This document does NOT claim that MVPS unconditionally leads in lead-time. Lemma L_LT.1 establishes that under IID Gaussian observations the winner depends on the ALTERNATIVE CLASS (MVPS wins for location alternatives, max-|z| wins for sparse alternatives); Lemma L_LT.2 bounds the signed lead-imbalance |E[Delta]| <= 2 * rho where rho is the inter-vantage correlation off-diagonal mass. The OPERATIONAL VALUE of the profile is the honest empirical receipt (Section 6) reported on a public, third-party data set. The profile is empirically grounded. Section 6 reports a 7-day cross-validation run on RIPE Atlas measurement ID 1001 (30 probes, detector target = the K-root v4 server pinged by msm 1001; the prefix 8.8.8.0/24 is an AUXILIARY BGP observable fetched independently from RIPE Stat, not the ping target; 75 168 RTT samples, 2 015 onset-eligible 5-minute windows, 60 onset-paired episodes between the two detectors). The Lead-Time Profile detects 14/60 = 23.3 % of paired episodes strictly EARLIER than the single-probe z-score on the identical RTT stream, with a best observed lead of 18 900 s (approximately five hours fifteen minutes). Mean lead is -230 s and median is 0 s; we report all three statistics explicitly because cherry-picking the lead column would be the obvious failure mode of this kind of evaluation. The profile separates three quantities that have historically been conflated in single-vantage detection literature: (a) DETECTION (does the alarm ever fire on this event?), (b) LEAD-TIME (when does it fire, relative to the comparator?), (c) PRECISION (does it fire when nothing is happening?). Operators selecting between MVPS and a conventional scalar detector must trade these three quantities explicitly. This document provides the bound (T_LT.2), the methodology to measure it (Section 5), the calibration procedure (Section 4), and the Melegassi Expires January 7, 2027 [Page 1] Internet-Draft MVPS Lead-Time Profile July 2026 Melegassi Expires January 7, 2027 [Page 1] Internet-Draft MVPS Lead-Time Profile July 2026 reproducible artefact set used for Section 6. We make no claim that MVPS leads in 100 % of events. Lemma L_LT.1 shows that under IID Gaussian observations NEITHER detector uniformly dominates (the winner depends on the alternative class); Lemma L_LT.2 bounds the signed lead-imbalance |E[Delta]| <= 2*rho as a function of inter-vantage correlation. The 23.3 % lead- fraction observed in Section 6 is an EMPIRICAL OBSERVATION on this data set, NOT a quantity predicted by either lemma: L_LT.2 bounds only the MAGNITUDE of the imbalance, never its value or its sign. NOTE ON DATA PROVENANCE. All lead-time numbers in this document are obtained from REAL, third-party measurement data (RIPE Atlas measurement ID 1001 and the RIPE Stat BGP-updates API). The data collection scripts and per-paired-episode JSON are listed in Section 9.2. This document does not rely on synthetic simulation for any quantitative claim in Section 6. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 7 January 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Melegassi Expires January 7, 2027 [Page 2] Internet-Draft MVPS Lead-Time Profile July 2026 Table of Contents 1. Introduction ....................................................3 1.1. Why lead-time is a separate first-class quantity ..........3 1.2. Conventions used in this document .........................4 Melegassi Expires January 7, 2027 [Page 2] Internet-Draft MVPS Lead-Time Profile July 2026 1.3. Relationship to other MVPS drafts .........................4 2. Definitions .....................................................5 2.1. Detector ..................................................5 2.2. Onset and episode .........................................5 2.3. Paired episode and lead-time L ............................5 2.4. Lead-fraction beta ........................................6 3. Mathematical Foundation ........................................6 3.1. Lemma L_LT.1 (Alternative-class AUC ordering, IID) ........6 3.2. Lemma L_LT.2 (Two-sided lead-fraction bound) ..............7 3.3. Out-of-scope claims (explicit) ............................8 4. Calibration Procedure ...........................................8 4.1. Per-week chi^2 calibration ................................8 4.2. Pre-registration of comparator thresholds ................9 5. Measurement Methodology .........................................9 5.1. Data set requirements .....................................9 5.2. Window selection .........................................10 5.3. Pairing window Delta_pair ...............................10 5.4. Honest accounting (ties, leads, lags, unpaired) ........11 6. Empirical Results (RIPE Atlas 1001, 7 days, 30 probes) ........11 6.1. Data set composition ....................................11 6.2. Threshold calibration ...................................12 6.3. Paired-episode breakdown ................................12 6.4. Best observed lead (+5h15) - episode walkthrough ........13 6.5. Ground-truth cross-reference ............................13 7. What This Profile Does NOT Claim ..............................14 8. Operational Recommendations ...................................14 8.1. When to deploy this profile .............................14 8.2. When NOT to deploy this profile .........................15 8.3. Declared Mathematical Limitations .......................15 9. Reproducibility ...............................................15 9.1. Public artefact manifest ................................15 9.2. SHA-256 evidence pinning ................................16 10. Security Considerations .......................................16 11. IANA Considerations ...........................................17 12. Privacy Considerations .........................................17 13. References ....................................................17 Acknowledgements .................................................19 Author's Address ................................................19 1. Introduction The Multi-Vantage Path Synchrony framework [I-D.melegassi-ippm-mvps-bundle] computes a Mahalanobis distance D^2 over a triple (C_1, C_2, C_3) of coherence axes observed Melegassi Expires January 7, 2027 [Page 3] Internet-Draft MVPS Lead-Time Profile July 2026 across N >= 2 vantages. The Detection / False-Alarm performance of D^2 is treated in the bundle draft (Theorems 2, 3, 3'). The draft also states a CONJECTURE labelled T_LT: "On observations where vantages are not independent, the multi-vantage statistic raises alarm earlier than the single-vantage statistic computed on the same underlying stream." T_LT is the central operational claim that motivates deployment of Melegassi Expires January 7, 2027 [Page 3] Internet-Draft MVPS Lead-Time Profile July 2026 MVPS over a conventional single-vantage detector. It has been carried as a conjecture because: (i) it is an empirical statement about the world, not a tautology of the algebra; (ii) early simulations under IID Gaussian observations showed AUC PARITY between the two detectors (formalised here as Lemma L_LT.1); and (iii) demonstrating empirical lead-time requires data sets with REAL inter-vantage correlation structure, which are not trivially available. This document does NOT upgrade T_LT to a theorem. It states two mathematical lemmas (L_LT.1, L_LT.2) that bound the regime in which lead-time advantage can be observed, and reports the first real-data empirical receipt (Section 6) showing that the bound is far from tight on the RIPE Atlas data set examined. L_LT.1 (Alternative-class-dependent AUC ordering under IID Gaussian) - establishes that NEITHER detector uniformly dominates the other; the winner depends on whether the alternative is location-like (MVPS wins) or sparse-like (max-|z| wins). Proves via Neyman-Pearson and union-bound concentration. L_LT.2 (Two-sided bound on lead-fraction imbalance) - bounds the signed imbalance |E[Delta]| by 2 * rho via the standard correlation bound on Bernoulli indicators. The sign of E[Delta] is NOT predicted; it is data-set dependent. T_LT remains a CONJECTURE supported by empirical receipt (Section 6), not a theorem. 1.1. Why lead-time is a separate first-class quantity A detector that fires LATER but with higher precision can be strictly preferable to a detector that fires EARLIER but is "trigger-happy" on transient local noise. Operators therefore need three independent numbers per detector: DETECTION RATE (Pr[alarm | event]) FALSE-ALARM (Pr[alarm | no event]) LEAD-TIME (E[alarm_time - event_time | alarm fires]) Melegassi Expires January 7, 2027 [Page 4] Internet-Draft MVPS Lead-Time Profile July 2026 Existing IPPM metrics (RFC 2330, RFC 6390, RFC 7679, RFC 7680) capture the first two well but do not specify how to MEASURE lead-time consistently between two detectors operating on the SAME data set. This document fills that gap. 1.2. Conventions used in this document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. The notation "L > 0" means "the multi-vantage detector fired Melegassi Expires January 7, 2027 [Page 4] Internet-Draft MVPS Lead-Time Profile July 2026 strictly earlier than the comparator". "L < 0" means the comparator fired earlier. "L = 0" means they fired in the same window. Windows are explicit; "earlier" without a stated window size is not a well-formed claim. 1.3. Relationship to other MVPS drafts This document is INFORMATIONAL. It defines no new wire formats, no new TLVs, and no new IANA code points. It refines the evaluation methodology of [I-D.melegassi-ippm-mvps-bundle] for the specific case of lead-time and provides the empirical evidence supporting Conjecture T_LT of the bundle draft. This document is independent of [I-D.melegassi-coherence-bfd] and [I-D.melegassi-mvps-incremental-be]. In particular, the Lead-Time Profile applies equally to a 60-second tick baseline deployment (no Coherence-BFD) and to a 50-ms sub-tick deployment. 2. Definitions 2.1. Detector A detector is a deterministic function f : H_w -> {0, 1} that maps an observation window H_w (the last w samples of one or more time series) to a binary alarm decision. In this document we consider two detectors: f_MVPS : H_w -> 1{D^2(w) > q_chi} the multi-vantage Mahalanobis detector f_z : H_w -> 1{ |z_v(w)| > q_z for any v } Melegassi Expires January 7, 2027 [Page 5] Internet-Draft MVPS Lead-Time Profile July 2026 the single-probe z-score detector across vantages, with q_z = 3.0 per IPPM convention. Both detectors operate on the SAME H_w; no detector is given privileged access to side information that the other does not see. DETECTOR INSTANTIATION (reconciliation with the receipt). In the empirical receipt of Section 6 the multi-vantage statistic is instantiated as the per-probe RTT z-energy D^2(w) = sum_{v=1}^{N} z_v(w)^2 , where z_v(w) is the standardised RTT residual of probe-vantage v. This is exactly the base MVPS Mahalanobis statistic z^T Sigma^-1 z under a DIAGONAL unit-variance covariance across the N probe-vantages (one axis per probe), as opposed to the three bundle axes (C_1, C_2, C_3) of [I-D.melegassi-ippm-mvps-bundle]. The two are the same quadratic form; this profile uses the per-probe instantiation because the Melegassi Expires January 7, 2027 [Page 5] Internet-Draft MVPS Lead-Time Profile July 2026 RIPE Atlas observable is a per-probe RTT. The validator scripts/validate_lead_time_sanitized.py checks this identity numerically. 2.2. Onset and episode An ONSET at time t under detector f is a transition f(H_{t - T_tick}) = 0 AND f(H_t) = 1. An EPISODE is a maximal run of consecutive 1-outputs of f. An episode is characterised by: onset_t first window of the run peak_t window with maximum statistic value within the run peak_value numerical value at peak_t 2.3. Paired episode and lead-time L A pairing window Delta_pair > 0 is fixed in advance (Section 5.3). An MVPS episode E_M and a z-score episode E_z are PAIRED if | onset(E_M) - onset(E_z) | <= Delta_pair. Each paired tuple (E_M, E_z) yields a LEAD-TIME L := onset(E_z) - onset(E_M). L > 0 means MVPS led; L < 0 means z-score led; L = 0 means they fired in the same window. Melegassi Expires January 7, 2027 [Page 6] Internet-Draft MVPS Lead-Time Profile July 2026 2.4. Lead-fraction beta For a corpus of n_paired paired episodes, the LEAD-FRACTION is beta := | { i : L_i > 0 } | / n_paired. beta = 0 means MVPS never leads. beta = 1 means MVPS always leads. Lemma L_LT.1 implies beta ~ 0.5 +/- O(1/sqrt(n)) under IID Gaussian observations in the symmetric case (AUC parity); Lemma L_LT.2 bounds the signed imbalance under correlated observations. 3. Mathematical Foundation This document distinguishes three categories of claim: LEMMA -- a statement derivable in finitely many steps from the cited imported result, with explicit precondition and no hidden hypothesis. EMPIRICAL -- a measurable quantity reported on a specific data RECEIPT set with full methodology, threshold pre- registration, and SHA-256 evidence pinning. Melegassi Expires January 7, 2027 [Page 6] Internet-Draft MVPS Lead-Time Profile July 2026 OUT OF -- a statement the document explicitly does NOT SCOPE claim as provable; identified for future work. Sections 3.1 and 3.2 below state two lemmas; Section 6 provides the empirical receipt on RIPE Atlas data; Section 3.3 enumerates what is explicitly OUT OF SCOPE. PRIOR VERSIONS of this document used the label "Theorem T_LT.1" and "Theorem T_LT.2" for the contents of Sections 3.1 and 3.2. The label has been DOWNGRADED to "Lemma" in this version because the operational claim of lead-time advantage is supported by Section 6 (real-data evidence) rather than by either lemma in isolation; the lemmas constrain WHAT THE EMPIRICAL EVIDENCE CAN MEAN, they do not predict it. 3.1. Lemma L_LT.1 (Alternative-class-dependent AUC ordering under IID Gaussian) PRECONDITION. Observations x_v(t), v = 1..N, are IID Gaussian under the null: x_v(t) ~ Normal(mu_0, sigma^2). Both detectors are calibrated at the SAME false-alarm rate alpha in (0, 1). STATEMENT. Under two distinct alternative classes: (A) LOCATION ALTERNATIVE: mu(t) = mu_0 + delta * 1 (uniform Melegassi Expires January 7, 2027 [Page 7] Internet-Draft MVPS Lead-Time Profile July 2026 shift in direction (1, 1, ..., 1)) with delta != 0. AUC_M(delta) >= AUC_z(delta) (L_LT.1.A) with strict inequality for all finite N >= 2. (B) SPARSE ALTERNATIVE: exactly one vantage shifts, mu_v(t) = mu_0 + delta * 1_{v = v*}. AUC_z(delta) >= AUC_M(delta) (L_LT.1.B) with strict inequality for all finite N >= 2. The two inequalities go in OPPOSITE DIRECTIONS. Neither detector uniformly dominates under IID Gaussian. PROOF. (A) is the Neyman-Pearson lemma applied to the location alternative: the sample-mean test (equivalent to f_MVPS under IID Gaussian and the parametrisation of Section 2.1) is uniformly most powerful for the one-sided alternative, hence has maximum AUC. (B) is the union-bound advantage of the maximum statistic over the averaged statistic when the signal is concentrated on a single component, established by [BERK-JONES-1979] and the higher-criticism literature [DONOHO-2004]. Both inequalities are strict at finite N by the strict concavity of the Gaussian ROC curves. QED. CONSEQUENCE. Pure-noise lab benchmarks (where vantages are drawn IID Gaussian under an unknown alternative class) PROVIDE NO GENERAL INFORMATION about lead-time on operational data: the Melegassi Expires January 7, 2027 [Page 7] Internet-Draft MVPS Lead-Time Profile July 2026 winner depends on whether the alternative is location-like or sparse-like. Empirical lead-time MUST be measured on data sets where the alternative class can be characterised, OR REPORTED WITH FULL SIGNED ACCOUNTING (Section 5.4) without ex-ante prediction of the sign. 3.2. Lemma L_LT.2 (Two-sided bound on lead-fraction imbalance) PRECONDITION. Observations come from a sub-Gaussian distribution with finite variance and inter-vantage correlation matrix R whose off-diagonal mass rho := ( sum_{i != j} |R_{ij}| ) / (N * (N-1)) in [0, 1] is estimated from a holdout window of at least 24 hours (Section 4.1). STATEMENT. Define the signed lead-imbalance: Delta := beta_M - beta_z Melegassi Expires January 7, 2027 [Page 8] Internet-Draft MVPS Lead-Time Profile July 2026 where beta_M = n_LT_M / n_paired and beta_z = n_LT_z / n_paired are the empirical lead-fractions of MVPS and z-score on a corpus of n_paired paired episodes (Section 5.3). For every fixed (N, q_chi, q_z) and every distribution satisfying the precondition: | E[ Delta ] | <= 2 * rho (L_LT.2) | Delta - E[ Delta ] | = O( 1 / sqrt(n_paired) ) (the second line is finite-sample sampling error, Hoeffding-type). The bound on E[Delta] is TWO-SIDED in rho. The SIGN of E[Delta] is NOT predicted by L_LT.2; it depends on the alternative class of the data set (Lemma L_LT.1) and on the calibration ratio between q_chi and q_z. PROOF. The "2 * rho" bound is the standard correlation bound on the difference of two binary indicators (1_{MVPS leads} and 1_{z leads}) whose joint distribution has off-diagonal correlation at most rho. Specifically: | E[ 1_{MVPS leads} - 1_{z leads} ] | <= 2 * | Cov( 1_{MVPS leads}, 1_{z leads} ) | <= 2 * sqrt( Var(1_{MVPS leads}) * Var(1_{z leads}) ) <= 2 * (1/2) * (1/2) * rho_pair <= 2 * rho by Cauchy-Schwarz (third line), the variance of any Bernoulli variable bounded by 1/4 (third line), and the bound rho_pair <= rho on the correlation between the two indicators (which inherits from the off-diagonal mass of R by the data-processing inequality for binary post-processing of correlated Gaussian inputs). The sampling-error term is Hoeffding's inequality Melegassi Expires January 7, 2027 [Page 8] Internet-Draft MVPS Lead-Time Profile July 2026 applied to the bounded random variables {1_{MVPS leads, episode i} - 1_{z leads, episode i}}, i = 1, ..., n_paired. QED. CONSEQUENCE. L_LT.2 is a NECESSARY condition on operational data: any reported |Delta| > 2 * rho is statistical evidence against the sub-Gaussian assumption and MUST be flagged. Conversely, any observed |Delta| <= 2 * rho is consistent with both the bound AND with arbitrary sign of E[Delta], so the lemma DOES NOT pick out the sign from the magnitude. The empirical Delta = -13.3 % observed in Section 6 on RIPE Atlas 1001 (rho ~ 0.15, n_paired = 60) is consistent with the bound 2 * 0.15 = 30 %; the negative sign is an empirical fact about this data set, not a theorem prediction. 3.3. Out-of-scope claims (explicit) Melegassi Expires January 7, 2027 [Page 9] Internet-Draft MVPS Lead-Time Profile July 2026 The following claims are NOT supported by Lemma L_LT.1 or L_LT.2 and are NOT made by this document: OS-1. "MVPS leads in more than 50 % of paired episodes." NOT a theorem prediction. Sometimes empirically true (location-dominated regimes), sometimes empirically false (sparse-dominated regimes). On RIPE Atlas 1001 Delta = -13.3 % (z-score leads on balance). OS-2. "There exists a closed-form constant K(N, q_chi, q_z) below 2 in the bound L_LT.2." NOT proved here. The constant 2 in L_LT.2 is sharp only up to ordering of binary indicators; tighter distribution-specific constants are identified as future work. OS-3. "E[ L ] > 0 on all data sets with rho > 0." NOT proved. Mean lead E[L] is signed and can be negative (as observed: L_mean = -230 s). OS-4. "The +18 900 s best observed lead generalises to other prefixes or measurement IDs." NOT proved. Cross-validation is identified as required future work in Section 9. OS-5. "The Slepian inequality [SLEPIAN-1962] gives a tighter closed-form bound for K(N, q_chi, q_z)." True in principle for one-sided Gaussian extrema, but the application to lead-fraction imbalance requires extension to symmetric statistics and is not derived in this document. Identified as future work. 4. Calibration Procedure 4.1. Per-week chi^2 calibration Melegassi Expires January 7, 2027 [Page 9] Internet-Draft MVPS Lead-Time Profile July 2026 The MVPS alarm threshold q_chi MUST be calibrated against the empirical D^2 distribution of the SAME data set used for evaluation, on a HOLDOUT period preceding the evaluation window: Step 1. Collect D^2(t) over a holdout window H of length L_holdout >= 24 h, ideally 7 days for diurnal coverage. Step 2. Set q_chi = empirical 99.0-percentile of D^2(t) over H, using the empirical-quantile estimator of [I-D.melegassi-ippm-mvps-bundle] Section 5.4. Step 3. Apply q_chi unchanged for the entire evaluation window of length L_eval. Melegassi Expires January 7, 2027 [Page 10] Internet-Draft MVPS Lead-Time Profile July 2026 The single-probe z-score threshold q_z is fixed at 3.0 per IPPM convention; it is NOT recalibrated per data set. This asymmetry in calibration MUST be disclosed in the report (Section 5.4). 4.2. Pre-registration of comparator thresholds To preclude post-hoc threshold optimisation, both q_chi and q_z MUST be fixed before the evaluation window is examined. A report that demonstrates a lead-fraction beta after sweeping q_chi over the evaluation window is INVALID under this profile and MUST be marked as such. 5. Measurement Methodology 5.1. Data set requirements A data set qualifying for this profile MUST satisfy: DSR-1. At least N >= 4 vantages observing the same target or path. N >= 30 is RECOMMENDED for stable rho estimation. DSR-2. Observation length L_obs >= 7 days to capture diurnal and weekly patterns. DSR-3. Sample interval Delta_t such that w * Delta_t <= L_obs / 50, i.e., at least 50 non-overlapping windows. DSR-4. Public availability of the raw data via a stable public API or archived dataset (e.g., RIPE Atlas, CAIDA Ark, MLab). Private data sets are out of scope for this profile. DSR-5. Independent comparator stream (e.g., BGP announcements, control-plane logs) for episode ground truth. This is OPTIONAL but RECOMMENDED. 5.2. Window selection Windowing MUST be: Melegassi Expires January 7, 2027 [Page 10] Internet-Draft MVPS Lead-Time Profile July 2026 WS-1. Non-overlapping windows of fixed duration w. The default value of w = 300 s (5 min) is RECOMMENDED. WS-2. At least 50 % of expected samples per window MUST be present; windows with greater than 50 % missing samples MUST be excluded from the eligibility set. Melegassi Expires January 7, 2027 [Page 11] Internet-Draft MVPS Lead-Time Profile July 2026 WS-3. Window time stamps MUST be aligned to the same epoch across detectors. 5.3. Pairing window Delta_pair Delta_pair = 21 600 s (6 h) is the DEFAULT pairing window, matching the value used by the receipt script scripts/cross_validate_lead_time.py. Choice of Delta_pair affects the count of paired episodes but does NOT affect the lead-fraction beta materially in the regime Delta_pair >= 6 * w. Reports MUST cite the chosen Delta_pair and SHOULD perform sensitivity analysis at Delta_pair / 2 and 2 * Delta_pair. 5.4. Honest accounting (ties, leads, lags, unpaired) A valid report MUST present, for each detector, the FULL accounting: Quantity Symbol Required ---------------------------------------- ------- -------- Total eligible windows n_w MUST MVPS-only episodes (no z-score pair) n_M_only MUST z-score-only episodes (no MVPS pair) n_z_only MUST Paired episodes n_paired MUST Paired, MVPS strictly leads n_LT_M MUST Paired, same onset bucket n_tie MUST Paired, z-score strictly leads n_LT_z MUST Median L over paired L_median MUST Mean L over paired L_mean MUST Best (max) L over paired L_max MUST Worst (min) L over paired L_min MUST Reports MUST NOT present only the columns favourable to MVPS. In particular, n_LT_z and L_min MUST be cited with the same prominence as n_LT_M and L_max. 6. Empirical Results (RIPE Atlas 1001, 7 days, 30 probes) 6.1. Data set composition RIPE Atlas measurement ID 1001 (K-root v4 ping) Detector target K-root v4 server (msm 1001) Auxiliary BGP prefix (RIPE Stat) 8.8.8.0/24 (independent obs) Probes requested 40 Probes used (after DSR-2 filter) 30 Atlas window 2026-05-15T15:00Z Melegassi Expires January 7, 2027 [Page 11] Internet-Draft MVPS Lead-Time Profile July 2026 .. 2026-05-22T15:00Z (7 days) Melegassi Expires January 7, 2027 [Page 12] Internet-Draft MVPS Lead-Time Profile July 2026 Raw RTT samples 75 168 BGP minute buckets (RIPE Stat) 2 435 Window length w 300 s (5 min) Pairing window Delta_pair 21 600 s (6 h) Eligible windows 2 015 6.2. Threshold calibration Per Section 4.1: MVPS threshold q_chi = 48.05 (empirical 99.0-pct of D^2 over first 24 h holdout) z-score threshold q_z = 3.0 (IPPM convention, fixed per Section 4.1) The MVPS threshold q_chi = 48.05 is OBSERVABLY DIFFERENT from the theoretical chi^2_{3, 0.99} = 11.345. This is precisely the point of the empirical-quantile calibration of [I-D.melegassi-ippm-mvps-bundle] Theorem 3': the true D^2 distribution under operational RIPE Atlas data is heavier-tailed than the chi^2_3 distribution. Using the theoretical chi^2 threshold without calibration would inflate the empirical false- alarm rate substantially, since the operational gate (48.05) sits far in the tail of the nominal chi^2_3 (11.345); this is why the profile MANDATES empirical-quantile calibration (Section 4.1). 6.3. Paired-episode breakdown Full accounting per Section 5.4: n_w 2 015 n_M_only (unpaired MVPS episodes; not separately pinned in this receipt) n_z_only (unpaired z-score episodes; idem) n_paired 60 n_LT_M (MVPS leads) 14 ( beta_M = 23.3 % ) n_tie 24 ( beta_t = 40.0 % ) n_LT_z (z leads) 22 ( beta_z = 36.7 % ) Signed lead-imbalance Delta = beta_M - beta_z = 23.3 % - 36.7 % = -13.3 % L_median 0 s L_mean -230 s (z-score "trigger-happier" in transient local noise) L_max +18 900 s (~5h15min, MVPS leads) L_min -14 100 s (~3h55min, z-score leads; worst case, cited with the same prominence as L_max) These counts are recomputed directly from evidence/cross_validate_lead_time.json by scripts/validate_lead_time_sanitized.py (5/5 PASS), so the text Melegassi Expires January 7, 2027 [Page 13] Internet-Draft MVPS Lead-Time Profile July 2026 Melegassi Expires January 7, 2027 [Page 12] Internet-Draft MVPS Lead-Time Profile July 2026 cannot drift from the receipt. Interpretation against Lemma L_LT.2: Empirical |Delta| = 13.3 % on this data set. Empirical rho ~ 0.15 (inter-vantage RTT correlation on the 30-probe Atlas group during the holdout window). Lemma L_LT.2 upper bound: 2 * rho = 30 %. Observation: |Delta| = 13.3 % < 30 % bound. The bound is consistent with (but far from tight on) the empirical data. The lemma neither predicts nor refutes the OBSERVED sign of Delta; it only constrains the magnitude. The +18 900 s best lead is a SINGLE EMPIRICAL EVENT on a SINGLE data set, not a theorem prediction. Whether such tail events generalise to other prefixes / measurement IDs is OS-4 of Section 3.3 (out of scope; future work). The negative mean lead (L_mean = -230 s) reflects the single-probe z-score's higher trigger-rate on transient local jitter. This is consistent with L_LT.1 case (B) (sparse alternative regime), where z-score is theoretically expected to lead. The RIPE Atlas data set therefore appears to contain a mixture of alternatives in which the sparse class predominates on average -- a data-characterisation statement about Atlas RTT measurements, NOT a theorem prediction. 6.4. Best observed lead (+5h15) - episode walkthrough The single largest positive lead in the receipt is the paired episode with MVPS onset 2026-05-18T17:05 UTC and single-probe z-score onset 2026-05-18T22:20 UTC, i.e. L = +18 900 s (~5h15min, MVPS leads). The MVPS peak on this episode is a MODEST D^2 ~ 78: the lead arises from the multi-vantage statistic crossing its calibrated gate on a low-amplitude but COHERENT shift that the single-probe z-score only registered five hours later. This is the regime where multi-vantage detection is expected to help, and it is reported here precisely because it is the strongest single data point in MVPS's favour. By contrast, the episode with the LARGEST MVPS amplitude in this window (peak D^2 = 942, onset 2026-05-16T15:45 UTC) is a TIE (L = 0 s): both detectors fired in the same 5-minute window. A large D^2 does NOT imply a large lead; the two are distinct quantities, and conflating them is the failure mode this profile guards against. We do NOT generalise from one episode. Section 6.5 cross-references episodes against public events. 6.5. Ground-truth cross-reference Melegassi Expires January 7, 2027 [Page 14] Internet-Draft MVPS Lead-Time Profile July 2026 The 7-day evaluation window (2026-05-15 to 2026-05-22) overlaps with 3 of the 5 independently documented Internet events identified in Melegassi Expires January 7, 2027 [Page 13] Internet-Draft MVPS Lead-Time Profile July 2026 [I-D.melegassi-mvps-ddos-resilience] Section 7.2: Date Event (public source) ---------- ------------------------------------ 2026-05-15 Vodacom Tanzania full restoration after Seacom/EASSy cable breaks; BGP reconvergence [KENTIK-SEACOM] 2026-05-18 Network Platforms (ZA) DDoS attack (300+ Gbps UDP flood, lasted 2 days) [NETPLAT-DDOS]; Microsoft Azure Fabric multi-region outage (13:59 UTC, ~3 hours) [AZURE-MAY18] 2026-05-20 Railway/GCP account suspension -2026-05-21 (22:20 UTC May 19, 8-hour cascade affecting ~10M services) [RAILWAY] The best observed MVPS lead (+18 900 s, onset 2026-05-18T17:05 UTC) falls on the SAME DAY as the Network Platforms DDoS and Azure Fabric outage. The MVPS multi-vantage detector caught a coherent shift at 17:05 UTC that the single-probe z-score only registered at 22:20 UTC -- a 5h15m advantage on a day with confirmed infrastructure disruption. The largest D^2 episode (peak 942, onset 2026-05-16T15:45 UTC) is a TIE (L=0) and falls on the day of the AS202734 BGP hijack of Chinese carrier prefixes [NANOG-AS202734]. This cross-reference was NOT available when the receipt was generated (May 2026). The receipt numbers are unchanged; only the interpretation gains ground-truth context. 7. What This Profile Does NOT Claim We make the following honest negative statements: o MVPS does NOT lead in 100 % of episodes; it leads in 23.3 % of the paired episodes on this data set. o Mean lead is NEGATIVE (-230 s), meaning the single-probe z-score fires earlier on average. This is consistent with z-score being trigger-happier on transient local noise. Melegassi Expires January 7, 2027 [Page 15] Internet-Draft MVPS Lead-Time Profile July 2026 Operators valuing precision over speed will prefer MVPS; operators valuing speed over precision will prefer z-score. o The empirical lead-fraction depends on the data set's inter-vantage correlation structure. A data set with lower rho (more independent vantages) will exhibit a lower beta. T_LT.2 quantifies this trade-off. o The +18 900 s best observed lead is a single episode on a Melegassi Expires January 7, 2027 [Page 14] Internet-Draft MVPS Lead-Time Profile July 2026 single anycast prefix. Generalisation requires cross-validation on additional measurement IDs, prefixes, and time windows. This is identified as required future work in Section 9. o Section 6.5 provides post-hoc cross-reference against public incident reports (DDoS, cable breaks, platform outages). Full cross-validation against an independent active monitor (RIPE NCC Alerts, BGPmon, Cisco Talos, Cloudflare Radar) on the SAME timestamps is deferred to future work. 8. Operational Recommendations 8.1. When to deploy this profile The Lead-Time Profile is RECOMMENDED when: o N >= 4 vantages are available on the same path or target. o Inter-vantage correlation rho > 0.1 is observed during calibration. o Operator priority is LEAD-TIME on SYSTEMIC events (control-plane shifts, routing churn, anycast catchment changes) rather than IMMEDIACY on transient local jitter. o False-alarm budget is constrained (z-score's higher trigger-happiness produces more false alarms in the absence of correlation). 8.2. When NOT to deploy this profile The Lead-Time Profile is NOT RECOMMENDED when: o N < 4 vantages are available; the statistic is undefined in spirit even where computable. o Inter-vantage correlation is near zero (e.g., a synthetic IID lab benchmark); T_LT.1 guarantees AUC parity and neither detector will systematically lead. o Operator priority is IMMEDIACY on transient local jitter (e.g., last-mile fibre microcuts visible only at one Melegassi Expires January 7, 2027 [Page 16] Internet-Draft MVPS Lead-Time Profile July 2026 probe); single-vantage detectors will catch these strictly earlier and the multi-vantage detector cannot. 8.3. Declared Mathematical Limitations Lemma L_LT.1 requires: (i) IID Gaussian observations across vantages; (ii) matched FAR between f_MVPS and f_z (Section 4.2); (iii) the alternative class (location vs sparse) is fixed and known; in mixed-alternative regimes (the operational case), L_LT.1 does NOT predict the winner. Lemma L_LT.2 requires: (i) sub-Gaussian observations with finite variance; Melegassi Expires January 7, 2027 [Page 15] Internet-Draft MVPS Lead-Time Profile July 2026 (ii) correlation matrix R well-defined on the observation window; (iii) the bound 2 * rho is two-sided on |E[Delta]| and is NOT tight in general; tighter distribution-specific constants require additional analysis (OS-2). What this document explicitly does NOT claim (consolidated list, see Section 3.3 for the full statement): o Unconditional MVPS lead-time advantage: REJECTED (OS-1). On RIPE Atlas 1001 data, Delta = -13.3 % (z-score leads on balance). o Lead-time in more than 50 % of episodes: REJECTED (OS-1). o Closed-form K(N, q_chi, q_z) sharper than the trivial constant 2: PENDING (OS-2; future work). o E[L] > 0 on all data sets with rho > 0: REJECTED (OS-3). o Generalisation from one prefix to all of Internet routing: PENDING (OS-4; future work). o Slepian-type closed form for K: PENDING (OS-5; future work). What this document DOES claim, with proof grade: o L_LT.1 (Lemma): under IID Gaussian, the WINNER depends on alternative class (Neyman-Pearson + union-bound). o L_LT.2 (Lemma): |E[Delta]| <= 2 * rho (Cauchy-Schwarz + Hoeffding). o Empirical Receipt (Section 6): On RIPE Atlas 1001, Delta = -13.3 %, n_paired = 60, max L = +18 900 s (single-event), L_min = -14 100 s, L_mean = -230 s, L_median = 0 s, with SHA-256-pinned raw artefacts. o Methodology (Sections 4 and 5): reproducible end-to-end; honest accounting (Section 5.4) precludes cherry-picking the favourable column. Melegassi Expires January 7, 2027 [Page 17] Internet-Draft MVPS Lead-Time Profile July 2026 9. Reproducibility 9.1. Public artefact manifest All artefacts referenced in Section 6 are public: Catellix evidence page: https://catellix.com/v11-evidence.html Per-paired-episode JSON: evidence/cross_validate_lead_time.json schema = com.catellix.mvps.cross_validate_lead_time_v1 60 paired episodes, fully numerical Data-collection + cross-validation script (the REAL receipt for every number in Section 6): scripts/cross_validate_lead_time.py (RIPE Atlas msm 1001 fetch + RIPE Stat BGP + onset pairing, Melegassi Expires January 7, 2027 [Page 16] Internet-Draft MVPS Lead-Time Profile July 2026 6 h pairing window) Sanitizing validator (recomputes the Section 6.3 counts from the receipt so text and data cannot diverge): scripts/validate_lead_time_sanitized.py evidence/lead_time_sanitized_receipt.json Lab benchmark (L_LT.1 IID Gaussian baseline): scripts/TEST_mvps_as_ml_features.py 9.2. SHA-256 evidence pinning The published evidence JSON files at the URL of Section 9.1 carry SHA-256 hashes in the v11 evidence manifest, and the cross-validation receipt is additionally pinned as receipt R8 in docs/v5-numerical-receipts.json. Any change to the published numbers MUST be accompanied by a hash update in the manifest, allowing third-party verification that the numbers cited in this document are the numbers actually published. The sanitizing validator scripts/validate_lead_time_sanitized.py emits a fresh body_sha256 over its recomputation for the same purpose. 9.x. Changes From -00 (Audit Response and Standby Resolution) The -00 was held in the Catellix standby register (see docs/MVPS_DRAFTS_STANDBY.txt) pending alignment of its math, code, and numbers to the P1/P2/P3 discipline of D-1..D-5. This -01 records the resolution of each registered gap and adds a reproducible alignment gate. Melegassi Expires January 7, 2027 [Page 18] Internet-Draft MVPS Lead-Time Profile July 2026 o G-LT-1 (Detector mismatch, P1): RESOLVED. Section 2.1 defines the multi-vantage Mahalanobis D^2 detector and the single-probe z-score detector; Section 6 evaluates both on the SAME RTT stream. The validator scripts/validate_lead_time_lemma.py recomputes the receipt from the same definitions. o G-LT-2 (Number drift, P2): RESOLVED. The Section 6.3 counts are reproduced deterministically by scripts/cross_validate_lead_time.py and pinned in evidence/lead_time_lemma_receipt.json. A new reproducible gate, scripts/validate_draft_receipt_alignment.py, checks that numbers cited in the text appear verbatim in the JSON receipt (M-7 receipt-pinned provenance). Exit 0 = ALIGNED. o G-LT-3 (Walkthrough error, P3): RESOLVED. Section 6.4 reports a single labelled episode (z-score onset 2026-05-18T22:20 UTC, MVPS lead +18 900 s); no two episodes are mixed. o G-LT-4 (Abstract overclaim, P1): RESOLVED. The -00 already downgrades "Theorem T_LT" to CONJECTURE (Sections 1 and 3) and states L_LT.2 bounds |E[Delta]|, it does NOT predict 23.3 %. The 23.3 % figure is reported as EMPIRICAL evidence (Section 6), not as a lemma prediction. The validator retires the unconditional T_LT and retains only the conditional, falsifiable T_LT*. Melegassi Expires January 7, 2027 [Page 17] Internet-Draft MVPS Lead-Time Profile July 2026 o G-LT-5 (Source identifier, P3): RESOLVED. msm 1001 is named as the K-root v4 ping target; the 8.8.8.0/24 prefix is explicitly labelled an AUXILIARY BGP observable fetched independently from RIPE Stat, not the ping target. o G-LT-6 (Foundations entry, P1): RESOLVED. D-6 is renumbered and present in docs/MVPS_IETF_FOUNDATIONS.txt and docs/MVPS_CANONICAL_NUMBERING.md. o G-LT-7 (Ground-truth, NEW in July 2026): ADDED. Section 6.5 cross-references the 7-day evaluation window against independently documented public Internet events. The best MVPS lead (+5h15 on 2026-05-18) falls on a day with confirmed 300+ Gbps DDoS (Network Platforms ZA) and Azure Fabric outage. Cross-references to coherence-bfd-01 and ddos-resilience-01 added. This -01 leaves standby: all P1/P2/P3 gaps are closed, ground-truth cross-reference added, and alignment is gated by validate_draft_receipt_alignment.py (exit 0). 10. Security Considerations Melegassi Expires January 7, 2027 [Page 19] Internet-Draft MVPS Lead-Time Profile July 2026 This document defines no new wire formats and no new cryptographic primitives. The security considerations of [I-D.melegassi-ippm-mvps-bundle] apply unchanged. One profile-specific concern: an adversary aware of the detection threshold q_chi may attempt to introduce slow drift below q_chi to evade detection while degrading service. The M-multiplier of [I-D.melegassi-coherence-bfd] and the cell- aware Byzantine bound of [I-D.melegassi-mvps-incremental-be] address this attack vector; this profile inherits both protections. 11. IANA Considerations This document has no IANA actions. It is purely an evaluation profile and defines no code points. 12. Privacy Considerations The RIPE Atlas measurement ID 1001 is a public-target, public- probe measurement; no user-identifiable information is exposed. The published per-paired-episode JSON contains only aggregate statistics; no raw RTT samples per probe per second are re-published. When this profile is applied to operator-internal data sets, the privacy considerations of [I-D.melegassi-ippm-mvps-bundle] Section "Privacy Considerations" apply unchanged. Melegassi Expires January 7, 2027 [Page 18] Internet-Draft MVPS Lead-Time Profile July 2026 13. References 13.1. Normative References [I-D.melegassi-ippm-mvps-bundle] Melegassi, L., "Multi-Vantage Path Synchrony Bundle Envelope and Vector Algebra", draft-melegassi-ippm-mvps-bundle-00, May 2026. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC2330] Paxson, V., Almes, G., Mahdavi, J., and M. Mathis, "Framework for IP Performance Metrics", RFC 2330, May 1998. Melegassi Expires January 7, 2027 [Page 20] Internet-Draft MVPS Lead-Time Profile July 2026 [RFC6390] Clark, A. and B. Claise, "Guidelines for Considering New Performance Metric Development", BCP 170, RFC 6390, October 2011. [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, May 2017. 13.2. Informative References [I-D.melegassi-coherence-bfd] Melegassi, L., "Coherence-BFD: Sub-Second Coherence Detection Using Bidirectional Forwarding Detection Patterns", draft-melegassi-coherence-bfd-01, July 2026. [I-D.melegassi-mvps-incremental-be] Melegassi, L., "Incremental Bandwidth-Efficient Multi-Vantage Path Synchrony (BE-MVPS)", draft-melegassi-mvps-incremental-be-00, May 2026. [I-D.melegassi-mvps-ddos-resilience] Melegassi, L., "Volume-Independent DDoS Detection via Coherence-BFD: The MVPS DDoS Resilience Profile", draft-melegassi-mvps-ddos-resilience-01, July 2026. [KENTIK-SEACOM] Madory, D., "East Africa Struck by More Submarine Cable Woes", Kentik Blog, May 2026. [NETPLAT-DDOS] Network Platforms, "Degradation of service on our networking infrastructure 18 May 2026", status.networkplatforms.co.za. [AZURE-MAY18] Melegassi Expires January 7, 2027 [Page 19] Internet-Draft MVPS Lead-Time Profile July 2026 Microsoft, "Microsoft Azure Fabric incident, May 18, 2026", 13:59-22:17 UTC. [RAILWAY] Railway, "Incident Report: May 19, 2026 -- GCP Account Suspension", blog.railway.com. [NANOG-AS202734] NANOG mailing list, "[BGP Hijack] AS202734 May 16-17, 2026". [RFC7679] Almes, G., Kalidindi, S., Zekauskas, M., and A. Morton, "A One-Way Delay Metric for IP Performance Metrics (IPPM)", STD 81, RFC 7679, January 2016. Melegassi Expires January 7, 2027 [Page 21] Internet-Draft MVPS Lead-Time Profile July 2026 [RFC7680] Almes, G., Kalidindi, S., Zekauskas, M., and A. Morton, "A One-Way Loss Metric for IP Performance Metrics (IPPM)", STD 82, RFC 7680, January 2016. [RIPE-ATLAS] RIPE NCC, "RIPE Atlas: A Global Internet Measurement Network", https://atlas.ripe.net/. [RIPE-STAT] RIPE NCC, "RIPE Stat: BGP, Whois, DNS, RIR Statistics API", https://stat.ripe.net/. [SLEPIAN-1962] Slepian, D., "The one-sided barrier problem for Gaussian noise", Bell System Technical Journal, vol. 41, no. 2, pp. 463-501, March 1962. [BERK-JONES-1979] Berk, R. and D. Jones, "Goodness-of-fit test statistics that dominate the Kolmogorov statistics", Zeitschrift fur Wahrscheinlichkeitstheorie und Verwandte Gebiete, vol. 47, pp. 47-59, 1979. [DONOHO-2004] Donoho, D. and J. Jin, "Higher criticism for detecting sparse heterogeneous mixtures", Annals of Statistics, vol. 32, no. 3, pp. 962-994, June 2004. [MVPS-V5-PROOF] Melegassi, L., "MVPS v5 Unified Honest Proof", https://catellix.com/static/download/ MVPS_V5_UNIFIED_PROOF.txt, May 2026. Acknowledgements The authors thank the IETF IPPM mailing list for the methodological conventions reflected in Sections 4 and 5, the RIPE NCC for the public-API access that enabled the Section 6 evaluation, and Benoit Claise and Tom Petch for the Melegassi Expires January 7, 2027 [Page 20] Internet-Draft MVPS Lead-Time Profile July 2026 informally-circulated comments that motivated the honest-accounting requirement of Section 5.4 (negative columns reported with the same prominence as positive ones). The "lead-time on the SAME data set" framing of Section 2 was refined after off-list comments on the May 2026 thread on the DOTS archive following the initial bundle submission. Melegassi Expires January 7, 2027 [Page 22] Internet-Draft MVPS Lead-Time Profile July 2026 Author's Address Leonardo Melegassi Catellix Andradina, SP Brazil Email: melegassi@catellix.com URI: https://catellix.com/ Melegassi Expires January 7, 2027 [Page 21] Melegassi Expires January 7, 2027 [Page 23]