saymrwulf/anza-ed25519-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/anza-ed25519-verified.git synced 2026-09-04 20:24:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
anza-ed25519-verified/verification/Proofs/ScalarBytesSpec.lean

3309 lines
146 KiB
Text
Raw Normal View History

Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
/- Proofs/ScalarBytesSpec.lean — from_bytes_wide, stage 1: the 8×8
byte-unpack loops. For each word index I, bytes_word_loop_spec_I
proves the inner loop packs bytes 8I..8I+7 little-endian into word I
(split at j = 4 into head + tail per METHOD 4 — the 8-fold monolith
exceeds the elaboration budget). Disjoint-bit ORs become additions
via core Nat.two_pow_add_eq_or_of_lt. -/
import Proofs.ScalarWideSpec
import Proofs.ScalarLoop
open Aeneas Aeneas.Std Result
open curve25519
set_option maxHeartbeats 8000000
set_option linter.unusedSimpArgs false
set_option exponentiation.threshold 600
namespace ScalarProofs
open Aeneas.Std.WP
/-- Inner byte loop for word 0, iterations 4..7 + exit: continues the
accumulation from the mid-state (bytes 0..3 absorbed). -/
theorem bytes_word_loop_tail_0
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(iter : core.ops.range.Range Std.Usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w0.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 0#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [v, w1, w2, w3, w4, w5, w6, w7] ∧
v.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb0 : b0.val < 2^8 := by scalar_tac
have hbb1 : b1.val < 2^8 := by scalar_tac
have hbb2 : b2.val < 2^8 := by scalar_tac
have hbb3 : b3.val < 2^8 := by scalar_tac
have hbb4 : b4.val < 2^8 := by scalar_tac
have hbb5 : b5.val < 2^8 := by scalar_tac
have hbb6 : b6.val < 2^8 := by scalar_tac
have hbb7 : b7.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 4: byte 4
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
step as ⟨q4, hq4⟩
have hq4v : q4.val = 4 := by
simp [hq4, hp4, hst]
all_goals scalar_tac
step as ⟨x4, hx4⟩
simp [hb, hq4v] at hx4
step with UScalar.cast.step_spec as ⟨c4, hc4⟩
have hc4v : c4.val = b4.val := by
rw [hc4, UScalar.cast_val_eq, hx4]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s4, hsh4⟩
have hsv4 : s4.val = 32 := by
simp [hsh4, hst]
all_goals scalar_tac
step as ⟨t4, ht4⟩
have ht4v : t4.val = b4.val * 2^32 := by
rw [ht4]
simp [hsv4, hc4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u4, hu4⟩
simp [hw] at hu4
have hu4v : u4.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 := by rw [hu4]; exact hacc
step as ⟨y4, hy4⟩
have hy4v : y4.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 := by
have hult : u4.val < 2^32 := by rw [hu4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u4.val) (i := 32) hult b4.val
have hadd : u4.val ||| b4.val * 2^32 = u4.val + b4.val * 2^32 := by
calc u4.val ||| b4.val * 2^32
= u4.val ||| 2^32 * b4.val := by rw [Nat.mul_comm]
_ = 2^32 * b4.val ||| u4.val := Nat.lor_comm _ _
_ = 2^32 * b4.val + u4.val := hor.symm
_ = u4.val + b4.val * 2^32 := by ring
simp only [hy4, UScalar.val_or, ht4v]
rw [hadd, hu4v]
all_goals ring
step as ⟨wn4, hwn4⟩
try simp only [spec_ok]
-- j = 5: byte 5
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
step as ⟨q5, hq5⟩
have hq5v : q5.val = 5 := by
simp [hq5, hp5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨x5, hx5⟩
simp [hb, hq5v] at hx5
step with UScalar.cast.step_spec as ⟨c5, hc5⟩
have hc5v : c5.val = b5.val := by
rw [hc5, UScalar.cast_val_eq, hx5]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s5, hsh5⟩
have hsv5 : s5.val = 40 := by
simp [hsh5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨t5, ht5⟩
have ht5v : t5.val = b5.val * 2^40 := by
rw [ht5]
simp [hsv5, hc5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u5, hu5⟩
simp [hwn4, hw] at hu5
have hu5v : u5.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 := by rw [hu5]; exact hy4v
step as ⟨y5, hy5⟩
have hy5v : y5.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 := by
have hult : u5.val < 2^40 := by rw [hu5v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u5.val) (i := 40) hult b5.val
have hadd : u5.val ||| b5.val * 2^40 = u5.val + b5.val * 2^40 := by
calc u5.val ||| b5.val * 2^40
= u5.val ||| 2^40 * b5.val := by rw [Nat.mul_comm]
_ = 2^40 * b5.val ||| u5.val := Nat.lor_comm _ _
_ = 2^40 * b5.val + u5.val := hor.symm
_ = u5.val + b5.val * 2^40 := by ring
simp only [hy5, UScalar.val_or, ht5v]
rw [hadd, hu5v]
all_goals ring
step as ⟨wn5, hwn5⟩
try simp only [spec_ok]
-- j = 6: byte 6
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
step as ⟨q6, hq6⟩
have hq6v : q6.val = 6 := by
simp [hq6, hp6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨x6, hx6⟩
simp [hb, hq6v] at hx6
step with UScalar.cast.step_spec as ⟨c6, hc6⟩
have hc6v : c6.val = b6.val := by
rw [hc6, UScalar.cast_val_eq, hx6]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s6, hsh6⟩
have hsv6 : s6.val = 48 := by
simp [hsh6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨t6, ht6⟩
have ht6v : t6.val = b6.val * 2^48 := by
rw [ht6]
simp [hsv6, hc6v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u6, hu6⟩
simp [hwn5, hw] at hu6
have hu6v : u6.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 := by rw [hu6]; exact hy5v
step as ⟨y6, hy6⟩
have hy6v : y6.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 := by
have hult : u6.val < 2^48 := by rw [hu6v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u6.val) (i := 48) hult b6.val
have hadd : u6.val ||| b6.val * 2^48 = u6.val + b6.val * 2^48 := by
calc u6.val ||| b6.val * 2^48
= u6.val ||| 2^48 * b6.val := by rw [Nat.mul_comm]
_ = 2^48 * b6.val ||| u6.val := Nat.lor_comm _ _
_ = 2^48 * b6.val + u6.val := hor.symm
_ = u6.val + b6.val * 2^48 := by ring
simp only [hy6, UScalar.val_or, ht6v]
rw [hadd, hu6v]
all_goals ring
step as ⟨wn6, hwn6⟩
try simp only [spec_ok]
-- j = 7: byte 7
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
step as ⟨q7, hq7⟩
have hq7v : q7.val = 7 := by
simp [hq7, hp7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨x7, hx7⟩
simp [hb, hq7v] at hx7
step with UScalar.cast.step_spec as ⟨c7, hc7⟩
have hc7v : c7.val = b7.val := by
rw [hc7, UScalar.cast_val_eq, hx7]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s7, hsh7⟩
have hsv7 : s7.val = 56 := by
simp [hsh7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨t7, ht7⟩
have ht7v : t7.val = b7.val * 2^56 := by
rw [ht7]
simp [hsv7, hc7v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u7, hu7⟩
simp [hwn6, hw] at hu7
have hu7v : u7.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 := by rw [hu7]; exact hy6v
step as ⟨y7, hy7⟩
have hy7v : y7.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 := by
have hult : u7.val < 2^56 := by rw [hu7v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u7.val) (i := 56) hult b7.val
have hadd : u7.val ||| b7.val * 2^56 = u7.val + b7.val * 2^56 := by
calc u7.val ||| b7.val * 2^56
= u7.val ||| 2^56 * b7.val := by rw [Nat.mul_comm]
_ = 2^56 * b7.val ||| u7.val := Nat.lor_comm _ _
_ = 2^56 * b7.val + u7.val := hor.symm
_ = u7.val + b7.val * 2^56 := by ring
simp only [hy7, UScalar.val_or, ht7v]
rw [hadd, hu7v]
all_goals ring
step as ⟨wn7, hwn7⟩
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
refine ⟨y7, ?_, hy7v⟩
simp [hwn4, hwn5, hwn6, hwn7, hw, Array.set_val_eq]
/-- Inner byte loop, outer index 0: word 0 accumulates bytes
0..7 little-endian; the other words are untouched.
Iterations 0..3 here; 4..7 + exit in `bytes_word_loop_tail_0`
(the 8-fold monolith exceeds the elaboration budget — METHOD 4). -/
theorem bytes_word_loop_spec_0
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w0.val = 0) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 0#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [v, w1, w2, w3, w4, w5, w6, w7] ∧
v.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb0 : b0.val < 2^8 := by scalar_tac
have hbb1 : b1.val < 2^8 := by scalar_tac
have hbb2 : b2.val < 2^8 := by scalar_tac
have hbb3 : b3.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 0: byte 0
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
step as ⟨q0, hq0⟩
have hq0v : q0.val = 0 := by
simp [hq0, hp0]
all_goals scalar_tac
step as ⟨x0, hx0⟩
simp [hb, hq0v] at hx0
step with UScalar.cast.step_spec as ⟨c0, hc0⟩
have hc0v : c0.val = b0.val := by
rw [hc0, UScalar.cast_val_eq, hx0]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s0, hsh0⟩
have hsv0 : s0.val = 0 := by
simp [hsh0]
all_goals scalar_tac
step as ⟨t0, ht0⟩
have ht0v : t0.val = b0.val * 2^0 := by
rw [ht0]
simp [hsv0, hc0v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u0, hu0⟩
simp [hw] at hu0
have hu0v : u0.val = 0 := by rw [hu0]; exact hz
step as ⟨y0, hy0⟩
have hy0v : y0.val = b0.val := by
simp [hy0, UScalar.val_or, hu0v, ht0v]
step as ⟨wn0, hwn0⟩
try simp only [spec_ok]
-- j = 1: byte 1
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
step as ⟨q1, hq1⟩
have hq1v : q1.val = 1 := by
simp [hq1, hp1, hs0, he0]
all_goals scalar_tac
step as ⟨x1, hx1⟩
simp [hb, hq1v] at hx1
step with UScalar.cast.step_spec as ⟨c1, hc1⟩
have hc1v : c1.val = b1.val := by
rw [hc1, UScalar.cast_val_eq, hx1]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s1, hsh1⟩
have hsv1 : s1.val = 8 := by
simp [hsh1, hs0, he0]
all_goals scalar_tac
step as ⟨t1, ht1⟩
have ht1v : t1.val = b1.val * 2^8 := by
rw [ht1]
simp [hsv1, hc1v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u1, hu1⟩
simp [hwn0, hw] at hu1
have hu1v : u1.val = b0.val := by rw [hu1]; exact hy0v
step as ⟨y1, hy1⟩
have hy1v : y1.val = b0.val + b1.val * 2^8 := by
have hult : u1.val < 2^8 := by rw [hu1v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u1.val) (i := 8) hult b1.val
have hadd : u1.val ||| b1.val * 2^8 = u1.val + b1.val * 2^8 := by
calc u1.val ||| b1.val * 2^8
= u1.val ||| 2^8 * b1.val := by rw [Nat.mul_comm]
_ = 2^8 * b1.val ||| u1.val := Nat.lor_comm _ _
_ = 2^8 * b1.val + u1.val := hor.symm
_ = u1.val + b1.val * 2^8 := by ring
simp only [hy1, UScalar.val_or, ht1v]
rw [hadd, hu1v]
all_goals ring
step as ⟨wn1, hwn1⟩
try simp only [spec_ok]
-- j = 2: byte 2
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
step as ⟨q2, hq2⟩
have hq2v : q2.val = 2 := by
simp [hq2, hp2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨x2, hx2⟩
simp [hb, hq2v] at hx2
step with UScalar.cast.step_spec as ⟨c2, hc2⟩
have hc2v : c2.val = b2.val := by
rw [hc2, UScalar.cast_val_eq, hx2]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s2, hsh2⟩
have hsv2 : s2.val = 16 := by
simp [hsh2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨t2, ht2⟩
have ht2v : t2.val = b2.val * 2^16 := by
rw [ht2]
simp [hsv2, hc2v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u2, hu2⟩
simp [hwn1, hw] at hu2
have hu2v : u2.val = b0.val + b1.val * 2^8 := by rw [hu2]; exact hy1v
step as ⟨y2, hy2⟩
have hy2v : y2.val = b0.val + b1.val * 2^8 + b2.val * 2^16 := by
have hult : u2.val < 2^16 := by rw [hu2v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u2.val) (i := 16) hult b2.val
have hadd : u2.val ||| b2.val * 2^16 = u2.val + b2.val * 2^16 := by
calc u2.val ||| b2.val * 2^16
= u2.val ||| 2^16 * b2.val := by rw [Nat.mul_comm]
_ = 2^16 * b2.val ||| u2.val := Nat.lor_comm _ _
_ = 2^16 * b2.val + u2.val := hor.symm
_ = u2.val + b2.val * 2^16 := by ring
simp only [hy2, UScalar.val_or, ht2v]
rw [hadd, hu2v]
all_goals ring
step as ⟨wn2, hwn2⟩
try simp only [spec_ok]
-- j = 3: byte 3
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
step as ⟨q3, hq3⟩
have hq3v : q3.val = 3 := by
simp [hq3, hp3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨x3, hx3⟩
simp [hb, hq3v] at hx3
step with UScalar.cast.step_spec as ⟨c3, hc3⟩
have hc3v : c3.val = b3.val := by
rw [hc3, UScalar.cast_val_eq, hx3]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s3, hsh3⟩
have hsv3 : s3.val = 24 := by
simp [hsh3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨t3, ht3⟩
have ht3v : t3.val = b3.val * 2^24 := by
rw [ht3]
simp [hsv3, hc3v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u3, hu3⟩
simp [hwn2, hw] at hu3
have hu3v : u3.val = b0.val + b1.val * 2^8 + b2.val * 2^16 := by rw [hu3]; exact hy2v
step as ⟨y3, hy3⟩
have hy3v : y3.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 := by
have hult : u3.val < 2^24 := by rw [hu3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u3.val) (i := 24) hult b3.val
have hadd : u3.val ||| b3.val * 2^24 = u3.val + b3.val * 2^24 := by
calc u3.val ||| b3.val * 2^24
= u3.val ||| 2^24 * b3.val := by rw [Nat.mul_comm]
_ = 2^24 * b3.val ||| u3.val := Nat.lor_comm _ _
_ = 2^24 * b3.val + u3.val := hor.symm
_ = u3.val + b3.val * 2^24 := by ring
simp only [hy3, UScalar.val_or, ht3v]
rw [hadd, hu3v]
all_goals ring
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 0#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [v, w1, w2, w3, w4, w5, w6, w7] ∧
v.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [y3, w1, w2, w3, w4, w5, w6, w7] := by
simp [hwn0, hwn1, hwn2, hwn3, hw, Array.set_val_eq]
have hst3 : iter3.start.val = 4 := by
simp [hs3, hs2, hs1, hs0]
all_goals scalar_tac
have hend3 : iter3.«end» = 8#usize := by
simp [he3, he2, he1, he0]
exact bytes_word_loop_tail_0 bytes wn3 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
y3 w1 w2 w3 w4 w5 w6 w7 iter3 hb hwn3l hst3 hend3 hy3v
/-- Inner byte loop for word 1, iterations 4..7 + exit: continues the
accumulation from the mid-state (bytes 8..11 absorbed). -/
theorem bytes_word_loop_tail_1
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(iter : core.ops.range.Range Std.Usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w1.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 1#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, v, w2, w3, w4, w5, w6, w7] ∧
v.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 + b15.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb8 : b8.val < 2^8 := by scalar_tac
have hbb9 : b9.val < 2^8 := by scalar_tac
have hbb10 : b10.val < 2^8 := by scalar_tac
have hbb11 : b11.val < 2^8 := by scalar_tac
have hbb12 : b12.val < 2^8 := by scalar_tac
have hbb13 : b13.val < 2^8 := by scalar_tac
have hbb14 : b14.val < 2^8 := by scalar_tac
have hbb15 : b15.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 4: byte 12
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
step as ⟨q4, hq4⟩
have hq4v : q4.val = 12 := by
simp [hq4, hp4, hst]
all_goals scalar_tac
step as ⟨x4, hx4⟩
simp [hb, hq4v] at hx4
step with UScalar.cast.step_spec as ⟨c4, hc4⟩
have hc4v : c4.val = b12.val := by
rw [hc4, UScalar.cast_val_eq, hx4]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s4, hsh4⟩
have hsv4 : s4.val = 32 := by
simp [hsh4, hst]
all_goals scalar_tac
step as ⟨t4, ht4⟩
have ht4v : t4.val = b12.val * 2^32 := by
rw [ht4]
simp [hsv4, hc4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u4, hu4⟩
simp [hw] at hu4
have hu4v : u4.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 := by rw [hu4]; exact hacc
step as ⟨y4, hy4⟩
have hy4v : y4.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 := by
have hult : u4.val < 2^32 := by rw [hu4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u4.val) (i := 32) hult b12.val
have hadd : u4.val ||| b12.val * 2^32 = u4.val + b12.val * 2^32 := by
calc u4.val ||| b12.val * 2^32
= u4.val ||| 2^32 * b12.val := by rw [Nat.mul_comm]
_ = 2^32 * b12.val ||| u4.val := Nat.lor_comm _ _
_ = 2^32 * b12.val + u4.val := hor.symm
_ = u4.val + b12.val * 2^32 := by ring
simp only [hy4, UScalar.val_or, ht4v]
rw [hadd, hu4v]
all_goals ring
step as ⟨wn4, hwn4⟩
try simp only [spec_ok]
-- j = 5: byte 13
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
step as ⟨q5, hq5⟩
have hq5v : q5.val = 13 := by
simp [hq5, hp5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨x5, hx5⟩
simp [hb, hq5v] at hx5
step with UScalar.cast.step_spec as ⟨c5, hc5⟩
have hc5v : c5.val = b13.val := by
rw [hc5, UScalar.cast_val_eq, hx5]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s5, hsh5⟩
have hsv5 : s5.val = 40 := by
simp [hsh5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨t5, ht5⟩
have ht5v : t5.val = b13.val * 2^40 := by
rw [ht5]
simp [hsv5, hc5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u5, hu5⟩
simp [hwn4, hw] at hu5
have hu5v : u5.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 := by rw [hu5]; exact hy4v
step as ⟨y5, hy5⟩
have hy5v : y5.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 := by
have hult : u5.val < 2^40 := by rw [hu5v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u5.val) (i := 40) hult b13.val
have hadd : u5.val ||| b13.val * 2^40 = u5.val + b13.val * 2^40 := by
calc u5.val ||| b13.val * 2^40
= u5.val ||| 2^40 * b13.val := by rw [Nat.mul_comm]
_ = 2^40 * b13.val ||| u5.val := Nat.lor_comm _ _
_ = 2^40 * b13.val + u5.val := hor.symm
_ = u5.val + b13.val * 2^40 := by ring
simp only [hy5, UScalar.val_or, ht5v]
rw [hadd, hu5v]
all_goals ring
step as ⟨wn5, hwn5⟩
try simp only [spec_ok]
-- j = 6: byte 14
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
step as ⟨q6, hq6⟩
have hq6v : q6.val = 14 := by
simp [hq6, hp6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨x6, hx6⟩
simp [hb, hq6v] at hx6
step with UScalar.cast.step_spec as ⟨c6, hc6⟩
have hc6v : c6.val = b14.val := by
rw [hc6, UScalar.cast_val_eq, hx6]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s6, hsh6⟩
have hsv6 : s6.val = 48 := by
simp [hsh6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨t6, ht6⟩
have ht6v : t6.val = b14.val * 2^48 := by
rw [ht6]
simp [hsv6, hc6v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u6, hu6⟩
simp [hwn5, hw] at hu6
have hu6v : u6.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 := by rw [hu6]; exact hy5v
step as ⟨y6, hy6⟩
have hy6v : y6.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 := by
have hult : u6.val < 2^48 := by rw [hu6v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u6.val) (i := 48) hult b14.val
have hadd : u6.val ||| b14.val * 2^48 = u6.val + b14.val * 2^48 := by
calc u6.val ||| b14.val * 2^48
= u6.val ||| 2^48 * b14.val := by rw [Nat.mul_comm]
_ = 2^48 * b14.val ||| u6.val := Nat.lor_comm _ _
_ = 2^48 * b14.val + u6.val := hor.symm
_ = u6.val + b14.val * 2^48 := by ring
simp only [hy6, UScalar.val_or, ht6v]
rw [hadd, hu6v]
all_goals ring
step as ⟨wn6, hwn6⟩
try simp only [spec_ok]
-- j = 7: byte 15
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
step as ⟨q7, hq7⟩
have hq7v : q7.val = 15 := by
simp [hq7, hp7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨x7, hx7⟩
simp [hb, hq7v] at hx7
step with UScalar.cast.step_spec as ⟨c7, hc7⟩
have hc7v : c7.val = b15.val := by
rw [hc7, UScalar.cast_val_eq, hx7]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s7, hsh7⟩
have hsv7 : s7.val = 56 := by
simp [hsh7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨t7, ht7⟩
have ht7v : t7.val = b15.val * 2^56 := by
rw [ht7]
simp [hsv7, hc7v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u7, hu7⟩
simp [hwn6, hw] at hu7
have hu7v : u7.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 := by rw [hu7]; exact hy6v
step as ⟨y7, hy7⟩
have hy7v : y7.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 + b15.val * 2^56 := by
have hult : u7.val < 2^56 := by rw [hu7v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u7.val) (i := 56) hult b15.val
have hadd : u7.val ||| b15.val * 2^56 = u7.val + b15.val * 2^56 := by
calc u7.val ||| b15.val * 2^56
= u7.val ||| 2^56 * b15.val := by rw [Nat.mul_comm]
_ = 2^56 * b15.val ||| u7.val := Nat.lor_comm _ _
_ = 2^56 * b15.val + u7.val := hor.symm
_ = u7.val + b15.val * 2^56 := by ring
simp only [hy7, UScalar.val_or, ht7v]
rw [hadd, hu7v]
all_goals ring
step as ⟨wn7, hwn7⟩
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
refine ⟨y7, ?_, hy7v⟩
simp [hwn4, hwn5, hwn6, hwn7, hw, Array.set_val_eq]
/-- Inner byte loop, outer index 1: word 1 accumulates bytes
8..15 little-endian; the other words are untouched.
Iterations 0..3 here; 4..7 + exit in `bytes_word_loop_tail_1`
(the 8-fold monolith exceeds the elaboration budget — METHOD 4). -/
theorem bytes_word_loop_spec_1
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w1.val = 0) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 1#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, v, w2, w3, w4, w5, w6, w7] ∧
v.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 + b15.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb8 : b8.val < 2^8 := by scalar_tac
have hbb9 : b9.val < 2^8 := by scalar_tac
have hbb10 : b10.val < 2^8 := by scalar_tac
have hbb11 : b11.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 0: byte 8
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
step as ⟨q0, hq0⟩
have hq0v : q0.val = 8 := by
simp [hq0, hp0]
all_goals scalar_tac
step as ⟨x0, hx0⟩
simp [hb, hq0v] at hx0
step with UScalar.cast.step_spec as ⟨c0, hc0⟩
have hc0v : c0.val = b8.val := by
rw [hc0, UScalar.cast_val_eq, hx0]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s0, hsh0⟩
have hsv0 : s0.val = 0 := by
simp [hsh0]
all_goals scalar_tac
step as ⟨t0, ht0⟩
have ht0v : t0.val = b8.val * 2^0 := by
rw [ht0]
simp [hsv0, hc0v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u0, hu0⟩
simp [hw] at hu0
have hu0v : u0.val = 0 := by rw [hu0]; exact hz
step as ⟨y0, hy0⟩
have hy0v : y0.val = b8.val := by
simp [hy0, UScalar.val_or, hu0v, ht0v]
step as ⟨wn0, hwn0⟩
try simp only [spec_ok]
-- j = 1: byte 9
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
step as ⟨q1, hq1⟩
have hq1v : q1.val = 9 := by
simp [hq1, hp1, hs0, he0]
all_goals scalar_tac
step as ⟨x1, hx1⟩
simp [hb, hq1v] at hx1
step with UScalar.cast.step_spec as ⟨c1, hc1⟩
have hc1v : c1.val = b9.val := by
rw [hc1, UScalar.cast_val_eq, hx1]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s1, hsh1⟩
have hsv1 : s1.val = 8 := by
simp [hsh1, hs0, he0]
all_goals scalar_tac
step as ⟨t1, ht1⟩
have ht1v : t1.val = b9.val * 2^8 := by
rw [ht1]
simp [hsv1, hc1v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u1, hu1⟩
simp [hwn0, hw] at hu1
have hu1v : u1.val = b8.val := by rw [hu1]; exact hy0v
step as ⟨y1, hy1⟩
have hy1v : y1.val = b8.val + b9.val * 2^8 := by
have hult : u1.val < 2^8 := by rw [hu1v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u1.val) (i := 8) hult b9.val
have hadd : u1.val ||| b9.val * 2^8 = u1.val + b9.val * 2^8 := by
calc u1.val ||| b9.val * 2^8
= u1.val ||| 2^8 * b9.val := by rw [Nat.mul_comm]
_ = 2^8 * b9.val ||| u1.val := Nat.lor_comm _ _
_ = 2^8 * b9.val + u1.val := hor.symm
_ = u1.val + b9.val * 2^8 := by ring
simp only [hy1, UScalar.val_or, ht1v]
rw [hadd, hu1v]
all_goals ring
step as ⟨wn1, hwn1⟩
try simp only [spec_ok]
-- j = 2: byte 10
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
step as ⟨q2, hq2⟩
have hq2v : q2.val = 10 := by
simp [hq2, hp2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨x2, hx2⟩
simp [hb, hq2v] at hx2
step with UScalar.cast.step_spec as ⟨c2, hc2⟩
have hc2v : c2.val = b10.val := by
rw [hc2, UScalar.cast_val_eq, hx2]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s2, hsh2⟩
have hsv2 : s2.val = 16 := by
simp [hsh2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨t2, ht2⟩
have ht2v : t2.val = b10.val * 2^16 := by
rw [ht2]
simp [hsv2, hc2v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u2, hu2⟩
simp [hwn1, hw] at hu2
have hu2v : u2.val = b8.val + b9.val * 2^8 := by rw [hu2]; exact hy1v
step as ⟨y2, hy2⟩
have hy2v : y2.val = b8.val + b9.val * 2^8 + b10.val * 2^16 := by
have hult : u2.val < 2^16 := by rw [hu2v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u2.val) (i := 16) hult b10.val
have hadd : u2.val ||| b10.val * 2^16 = u2.val + b10.val * 2^16 := by
calc u2.val ||| b10.val * 2^16
= u2.val ||| 2^16 * b10.val := by rw [Nat.mul_comm]
_ = 2^16 * b10.val ||| u2.val := Nat.lor_comm _ _
_ = 2^16 * b10.val + u2.val := hor.symm
_ = u2.val + b10.val * 2^16 := by ring
simp only [hy2, UScalar.val_or, ht2v]
rw [hadd, hu2v]
all_goals ring
step as ⟨wn2, hwn2⟩
try simp only [spec_ok]
-- j = 3: byte 11
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
step as ⟨q3, hq3⟩
have hq3v : q3.val = 11 := by
simp [hq3, hp3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨x3, hx3⟩
simp [hb, hq3v] at hx3
step with UScalar.cast.step_spec as ⟨c3, hc3⟩
have hc3v : c3.val = b11.val := by
rw [hc3, UScalar.cast_val_eq, hx3]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s3, hsh3⟩
have hsv3 : s3.val = 24 := by
simp [hsh3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨t3, ht3⟩
have ht3v : t3.val = b11.val * 2^24 := by
rw [ht3]
simp [hsv3, hc3v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u3, hu3⟩
simp [hwn2, hw] at hu3
have hu3v : u3.val = b8.val + b9.val * 2^8 + b10.val * 2^16 := by rw [hu3]; exact hy2v
step as ⟨y3, hy3⟩
have hy3v : y3.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 := by
have hult : u3.val < 2^24 := by rw [hu3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u3.val) (i := 24) hult b11.val
have hadd : u3.val ||| b11.val * 2^24 = u3.val + b11.val * 2^24 := by
calc u3.val ||| b11.val * 2^24
= u3.val ||| 2^24 * b11.val := by rw [Nat.mul_comm]
_ = 2^24 * b11.val ||| u3.val := Nat.lor_comm _ _
_ = 2^24 * b11.val + u3.val := hor.symm
_ = u3.val + b11.val * 2^24 := by ring
simp only [hy3, UScalar.val_or, ht3v]
rw [hadd, hu3v]
all_goals ring
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 1#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, v, w2, w3, w4, w5, w6, w7] ∧
v.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 + b15.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, y3, w2, w3, w4, w5, w6, w7] := by
simp [hwn0, hwn1, hwn2, hwn3, hw, Array.set_val_eq]
have hst3 : iter3.start.val = 4 := by
simp [hs3, hs2, hs1, hs0]
all_goals scalar_tac
have hend3 : iter3.«end» = 8#usize := by
simp [he3, he2, he1, he0]
exact bytes_word_loop_tail_1 bytes wn3 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
w0 y3 w2 w3 w4 w5 w6 w7 iter3 hb hwn3l hst3 hend3 hy3v
/-- Inner byte loop for word 2, iterations 4..7 + exit: continues the
accumulation from the mid-state (bytes 16..19 absorbed). -/
theorem bytes_word_loop_tail_2
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(iter : core.ops.range.Range Std.Usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w2.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 2#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, v, w3, w4, w5, w6, w7] ∧
v.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 + b23.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb16 : b16.val < 2^8 := by scalar_tac
have hbb17 : b17.val < 2^8 := by scalar_tac
have hbb18 : b18.val < 2^8 := by scalar_tac
have hbb19 : b19.val < 2^8 := by scalar_tac
have hbb20 : b20.val < 2^8 := by scalar_tac
have hbb21 : b21.val < 2^8 := by scalar_tac
have hbb22 : b22.val < 2^8 := by scalar_tac
have hbb23 : b23.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 4: byte 20
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
step as ⟨q4, hq4⟩
have hq4v : q4.val = 20 := by
simp [hq4, hp4, hst]
all_goals scalar_tac
step as ⟨x4, hx4⟩
simp [hb, hq4v] at hx4
step with UScalar.cast.step_spec as ⟨c4, hc4⟩
have hc4v : c4.val = b20.val := by
rw [hc4, UScalar.cast_val_eq, hx4]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s4, hsh4⟩
have hsv4 : s4.val = 32 := by
simp [hsh4, hst]
all_goals scalar_tac
step as ⟨t4, ht4⟩
have ht4v : t4.val = b20.val * 2^32 := by
rw [ht4]
simp [hsv4, hc4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u4, hu4⟩
simp [hw] at hu4
have hu4v : u4.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 := by rw [hu4]; exact hacc
step as ⟨y4, hy4⟩
have hy4v : y4.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 := by
have hult : u4.val < 2^32 := by rw [hu4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u4.val) (i := 32) hult b20.val
have hadd : u4.val ||| b20.val * 2^32 = u4.val + b20.val * 2^32 := by
calc u4.val ||| b20.val * 2^32
= u4.val ||| 2^32 * b20.val := by rw [Nat.mul_comm]
_ = 2^32 * b20.val ||| u4.val := Nat.lor_comm _ _
_ = 2^32 * b20.val + u4.val := hor.symm
_ = u4.val + b20.val * 2^32 := by ring
simp only [hy4, UScalar.val_or, ht4v]
rw [hadd, hu4v]
all_goals ring
step as ⟨wn4, hwn4⟩
try simp only [spec_ok]
-- j = 5: byte 21
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
step as ⟨q5, hq5⟩
have hq5v : q5.val = 21 := by
simp [hq5, hp5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨x5, hx5⟩
simp [hb, hq5v] at hx5
step with UScalar.cast.step_spec as ⟨c5, hc5⟩
have hc5v : c5.val = b21.val := by
rw [hc5, UScalar.cast_val_eq, hx5]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s5, hsh5⟩
have hsv5 : s5.val = 40 := by
simp [hsh5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨t5, ht5⟩
have ht5v : t5.val = b21.val * 2^40 := by
rw [ht5]
simp [hsv5, hc5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u5, hu5⟩
simp [hwn4, hw] at hu5
have hu5v : u5.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 := by rw [hu5]; exact hy4v
step as ⟨y5, hy5⟩
have hy5v : y5.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 := by
have hult : u5.val < 2^40 := by rw [hu5v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u5.val) (i := 40) hult b21.val
have hadd : u5.val ||| b21.val * 2^40 = u5.val + b21.val * 2^40 := by
calc u5.val ||| b21.val * 2^40
= u5.val ||| 2^40 * b21.val := by rw [Nat.mul_comm]
_ = 2^40 * b21.val ||| u5.val := Nat.lor_comm _ _
_ = 2^40 * b21.val + u5.val := hor.symm
_ = u5.val + b21.val * 2^40 := by ring
simp only [hy5, UScalar.val_or, ht5v]
rw [hadd, hu5v]
all_goals ring
step as ⟨wn5, hwn5⟩
try simp only [spec_ok]
-- j = 6: byte 22
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
step as ⟨q6, hq6⟩
have hq6v : q6.val = 22 := by
simp [hq6, hp6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨x6, hx6⟩
simp [hb, hq6v] at hx6
step with UScalar.cast.step_spec as ⟨c6, hc6⟩
have hc6v : c6.val = b22.val := by
rw [hc6, UScalar.cast_val_eq, hx6]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s6, hsh6⟩
have hsv6 : s6.val = 48 := by
simp [hsh6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨t6, ht6⟩
have ht6v : t6.val = b22.val * 2^48 := by
rw [ht6]
simp [hsv6, hc6v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u6, hu6⟩
simp [hwn5, hw] at hu6
have hu6v : u6.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 := by rw [hu6]; exact hy5v
step as ⟨y6, hy6⟩
have hy6v : y6.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 := by
have hult : u6.val < 2^48 := by rw [hu6v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u6.val) (i := 48) hult b22.val
have hadd : u6.val ||| b22.val * 2^48 = u6.val + b22.val * 2^48 := by
calc u6.val ||| b22.val * 2^48
= u6.val ||| 2^48 * b22.val := by rw [Nat.mul_comm]
_ = 2^48 * b22.val ||| u6.val := Nat.lor_comm _ _
_ = 2^48 * b22.val + u6.val := hor.symm
_ = u6.val + b22.val * 2^48 := by ring
simp only [hy6, UScalar.val_or, ht6v]
rw [hadd, hu6v]
all_goals ring
step as ⟨wn6, hwn6⟩
try simp only [spec_ok]
-- j = 7: byte 23
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
step as ⟨q7, hq7⟩
have hq7v : q7.val = 23 := by
simp [hq7, hp7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨x7, hx7⟩
simp [hb, hq7v] at hx7
step with UScalar.cast.step_spec as ⟨c7, hc7⟩
have hc7v : c7.val = b23.val := by
rw [hc7, UScalar.cast_val_eq, hx7]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s7, hsh7⟩
have hsv7 : s7.val = 56 := by
simp [hsh7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨t7, ht7⟩
have ht7v : t7.val = b23.val * 2^56 := by
rw [ht7]
simp [hsv7, hc7v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u7, hu7⟩
simp [hwn6, hw] at hu7
have hu7v : u7.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 := by rw [hu7]; exact hy6v
step as ⟨y7, hy7⟩
have hy7v : y7.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 + b23.val * 2^56 := by
have hult : u7.val < 2^56 := by rw [hu7v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u7.val) (i := 56) hult b23.val
have hadd : u7.val ||| b23.val * 2^56 = u7.val + b23.val * 2^56 := by
calc u7.val ||| b23.val * 2^56
= u7.val ||| 2^56 * b23.val := by rw [Nat.mul_comm]
_ = 2^56 * b23.val ||| u7.val := Nat.lor_comm _ _
_ = 2^56 * b23.val + u7.val := hor.symm
_ = u7.val + b23.val * 2^56 := by ring
simp only [hy7, UScalar.val_or, ht7v]
rw [hadd, hu7v]
all_goals ring
step as ⟨wn7, hwn7⟩
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
refine ⟨y7, ?_, hy7v⟩
simp [hwn4, hwn5, hwn6, hwn7, hw, Array.set_val_eq]
/-- Inner byte loop, outer index 2: word 2 accumulates bytes
16..23 little-endian; the other words are untouched.
Iterations 0..3 here; 4..7 + exit in `bytes_word_loop_tail_2`
(the 8-fold monolith exceeds the elaboration budget — METHOD 4). -/
theorem bytes_word_loop_spec_2
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w2.val = 0) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 2#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, v, w3, w4, w5, w6, w7] ∧
v.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 + b23.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb16 : b16.val < 2^8 := by scalar_tac
have hbb17 : b17.val < 2^8 := by scalar_tac
have hbb18 : b18.val < 2^8 := by scalar_tac
have hbb19 : b19.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 0: byte 16
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
step as ⟨q0, hq0⟩
have hq0v : q0.val = 16 := by
simp [hq0, hp0]
all_goals scalar_tac
step as ⟨x0, hx0⟩
simp [hb, hq0v] at hx0
step with UScalar.cast.step_spec as ⟨c0, hc0⟩
have hc0v : c0.val = b16.val := by
rw [hc0, UScalar.cast_val_eq, hx0]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s0, hsh0⟩
have hsv0 : s0.val = 0 := by
simp [hsh0]
all_goals scalar_tac
step as ⟨t0, ht0⟩
have ht0v : t0.val = b16.val * 2^0 := by
rw [ht0]
simp [hsv0, hc0v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u0, hu0⟩
simp [hw] at hu0
have hu0v : u0.val = 0 := by rw [hu0]; exact hz
step as ⟨y0, hy0⟩
have hy0v : y0.val = b16.val := by
simp [hy0, UScalar.val_or, hu0v, ht0v]
step as ⟨wn0, hwn0⟩
try simp only [spec_ok]
-- j = 1: byte 17
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
step as ⟨q1, hq1⟩
have hq1v : q1.val = 17 := by
simp [hq1, hp1, hs0, he0]
all_goals scalar_tac
step as ⟨x1, hx1⟩
simp [hb, hq1v] at hx1
step with UScalar.cast.step_spec as ⟨c1, hc1⟩
have hc1v : c1.val = b17.val := by
rw [hc1, UScalar.cast_val_eq, hx1]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s1, hsh1⟩
have hsv1 : s1.val = 8 := by
simp [hsh1, hs0, he0]
all_goals scalar_tac
step as ⟨t1, ht1⟩
have ht1v : t1.val = b17.val * 2^8 := by
rw [ht1]
simp [hsv1, hc1v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u1, hu1⟩
simp [hwn0, hw] at hu1
have hu1v : u1.val = b16.val := by rw [hu1]; exact hy0v
step as ⟨y1, hy1⟩
have hy1v : y1.val = b16.val + b17.val * 2^8 := by
have hult : u1.val < 2^8 := by rw [hu1v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u1.val) (i := 8) hult b17.val
have hadd : u1.val ||| b17.val * 2^8 = u1.val + b17.val * 2^8 := by
calc u1.val ||| b17.val * 2^8
= u1.val ||| 2^8 * b17.val := by rw [Nat.mul_comm]
_ = 2^8 * b17.val ||| u1.val := Nat.lor_comm _ _
_ = 2^8 * b17.val + u1.val := hor.symm
_ = u1.val + b17.val * 2^8 := by ring
simp only [hy1, UScalar.val_or, ht1v]
rw [hadd, hu1v]
all_goals ring
step as ⟨wn1, hwn1⟩
try simp only [spec_ok]
-- j = 2: byte 18
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
step as ⟨q2, hq2⟩
have hq2v : q2.val = 18 := by
simp [hq2, hp2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨x2, hx2⟩
simp [hb, hq2v] at hx2
step with UScalar.cast.step_spec as ⟨c2, hc2⟩
have hc2v : c2.val = b18.val := by
rw [hc2, UScalar.cast_val_eq, hx2]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s2, hsh2⟩
have hsv2 : s2.val = 16 := by
simp [hsh2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨t2, ht2⟩
have ht2v : t2.val = b18.val * 2^16 := by
rw [ht2]
simp [hsv2, hc2v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u2, hu2⟩
simp [hwn1, hw] at hu2
have hu2v : u2.val = b16.val + b17.val * 2^8 := by rw [hu2]; exact hy1v
step as ⟨y2, hy2⟩
have hy2v : y2.val = b16.val + b17.val * 2^8 + b18.val * 2^16 := by
have hult : u2.val < 2^16 := by rw [hu2v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u2.val) (i := 16) hult b18.val
have hadd : u2.val ||| b18.val * 2^16 = u2.val + b18.val * 2^16 := by
calc u2.val ||| b18.val * 2^16
= u2.val ||| 2^16 * b18.val := by rw [Nat.mul_comm]
_ = 2^16 * b18.val ||| u2.val := Nat.lor_comm _ _
_ = 2^16 * b18.val + u2.val := hor.symm
_ = u2.val + b18.val * 2^16 := by ring
simp only [hy2, UScalar.val_or, ht2v]
rw [hadd, hu2v]
all_goals ring
step as ⟨wn2, hwn2⟩
try simp only [spec_ok]
-- j = 3: byte 19
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
step as ⟨q3, hq3⟩
have hq3v : q3.val = 19 := by
simp [hq3, hp3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨x3, hx3⟩
simp [hb, hq3v] at hx3
step with UScalar.cast.step_spec as ⟨c3, hc3⟩
have hc3v : c3.val = b19.val := by
rw [hc3, UScalar.cast_val_eq, hx3]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s3, hsh3⟩
have hsv3 : s3.val = 24 := by
simp [hsh3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨t3, ht3⟩
have ht3v : t3.val = b19.val * 2^24 := by
rw [ht3]
simp [hsv3, hc3v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u3, hu3⟩
simp [hwn2, hw] at hu3
have hu3v : u3.val = b16.val + b17.val * 2^8 + b18.val * 2^16 := by rw [hu3]; exact hy2v
step as ⟨y3, hy3⟩
have hy3v : y3.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 := by
have hult : u3.val < 2^24 := by rw [hu3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u3.val) (i := 24) hult b19.val
have hadd : u3.val ||| b19.val * 2^24 = u3.val + b19.val * 2^24 := by
calc u3.val ||| b19.val * 2^24
= u3.val ||| 2^24 * b19.val := by rw [Nat.mul_comm]
_ = 2^24 * b19.val ||| u3.val := Nat.lor_comm _ _
_ = 2^24 * b19.val + u3.val := hor.symm
_ = u3.val + b19.val * 2^24 := by ring
simp only [hy3, UScalar.val_or, ht3v]
rw [hadd, hu3v]
all_goals ring
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 2#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, v, w3, w4, w5, w6, w7] ∧
v.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 + b23.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, y3, w3, w4, w5, w6, w7] := by
simp [hwn0, hwn1, hwn2, hwn3, hw, Array.set_val_eq]
have hst3 : iter3.start.val = 4 := by
simp [hs3, hs2, hs1, hs0]
all_goals scalar_tac
have hend3 : iter3.«end» = 8#usize := by
simp [he3, he2, he1, he0]
exact bytes_word_loop_tail_2 bytes wn3 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
w0 w1 y3 w3 w4 w5 w6 w7 iter3 hb hwn3l hst3 hend3 hy3v
/-- Inner byte loop for word 3, iterations 4..7 + exit: continues the
accumulation from the mid-state (bytes 24..27 absorbed). -/
theorem bytes_word_loop_tail_3
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(iter : core.ops.range.Range Std.Usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w3.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 3#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, v, w4, w5, w6, w7] ∧
v.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 + b31.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb24 : b24.val < 2^8 := by scalar_tac
have hbb25 : b25.val < 2^8 := by scalar_tac
have hbb26 : b26.val < 2^8 := by scalar_tac
have hbb27 : b27.val < 2^8 := by scalar_tac
have hbb28 : b28.val < 2^8 := by scalar_tac
have hbb29 : b29.val < 2^8 := by scalar_tac
have hbb30 : b30.val < 2^8 := by scalar_tac
have hbb31 : b31.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 4: byte 28
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
step as ⟨q4, hq4⟩
have hq4v : q4.val = 28 := by
simp [hq4, hp4, hst]
all_goals scalar_tac
step as ⟨x4, hx4⟩
simp [hb, hq4v] at hx4
step with UScalar.cast.step_spec as ⟨c4, hc4⟩
have hc4v : c4.val = b28.val := by
rw [hc4, UScalar.cast_val_eq, hx4]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s4, hsh4⟩
have hsv4 : s4.val = 32 := by
simp [hsh4, hst]
all_goals scalar_tac
step as ⟨t4, ht4⟩
have ht4v : t4.val = b28.val * 2^32 := by
rw [ht4]
simp [hsv4, hc4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u4, hu4⟩
simp [hw] at hu4
have hu4v : u4.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 := by rw [hu4]; exact hacc
step as ⟨y4, hy4⟩
have hy4v : y4.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 := by
have hult : u4.val < 2^32 := by rw [hu4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u4.val) (i := 32) hult b28.val
have hadd : u4.val ||| b28.val * 2^32 = u4.val + b28.val * 2^32 := by
calc u4.val ||| b28.val * 2^32
= u4.val ||| 2^32 * b28.val := by rw [Nat.mul_comm]
_ = 2^32 * b28.val ||| u4.val := Nat.lor_comm _ _
_ = 2^32 * b28.val + u4.val := hor.symm
_ = u4.val + b28.val * 2^32 := by ring
simp only [hy4, UScalar.val_or, ht4v]
rw [hadd, hu4v]
all_goals ring
step as ⟨wn4, hwn4⟩
try simp only [spec_ok]
-- j = 5: byte 29
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
step as ⟨q5, hq5⟩
have hq5v : q5.val = 29 := by
simp [hq5, hp5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨x5, hx5⟩
simp [hb, hq5v] at hx5
step with UScalar.cast.step_spec as ⟨c5, hc5⟩
have hc5v : c5.val = b29.val := by
rw [hc5, UScalar.cast_val_eq, hx5]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s5, hsh5⟩
have hsv5 : s5.val = 40 := by
simp [hsh5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨t5, ht5⟩
have ht5v : t5.val = b29.val * 2^40 := by
rw [ht5]
simp [hsv5, hc5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u5, hu5⟩
simp [hwn4, hw] at hu5
have hu5v : u5.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 := by rw [hu5]; exact hy4v
step as ⟨y5, hy5⟩
have hy5v : y5.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 := by
have hult : u5.val < 2^40 := by rw [hu5v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u5.val) (i := 40) hult b29.val
have hadd : u5.val ||| b29.val * 2^40 = u5.val + b29.val * 2^40 := by
calc u5.val ||| b29.val * 2^40
= u5.val ||| 2^40 * b29.val := by rw [Nat.mul_comm]
_ = 2^40 * b29.val ||| u5.val := Nat.lor_comm _ _
_ = 2^40 * b29.val + u5.val := hor.symm
_ = u5.val + b29.val * 2^40 := by ring
simp only [hy5, UScalar.val_or, ht5v]
rw [hadd, hu5v]
all_goals ring
step as ⟨wn5, hwn5⟩
try simp only [spec_ok]
-- j = 6: byte 30
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
step as ⟨q6, hq6⟩
have hq6v : q6.val = 30 := by
simp [hq6, hp6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨x6, hx6⟩
simp [hb, hq6v] at hx6
step with UScalar.cast.step_spec as ⟨c6, hc6⟩
have hc6v : c6.val = b30.val := by
rw [hc6, UScalar.cast_val_eq, hx6]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s6, hsh6⟩
have hsv6 : s6.val = 48 := by
simp [hsh6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨t6, ht6⟩
have ht6v : t6.val = b30.val * 2^48 := by
rw [ht6]
simp [hsv6, hc6v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u6, hu6⟩
simp [hwn5, hw] at hu6
have hu6v : u6.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 := by rw [hu6]; exact hy5v
step as ⟨y6, hy6⟩
have hy6v : y6.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 := by
have hult : u6.val < 2^48 := by rw [hu6v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u6.val) (i := 48) hult b30.val
have hadd : u6.val ||| b30.val * 2^48 = u6.val + b30.val * 2^48 := by
calc u6.val ||| b30.val * 2^48
= u6.val ||| 2^48 * b30.val := by rw [Nat.mul_comm]
_ = 2^48 * b30.val ||| u6.val := Nat.lor_comm _ _
_ = 2^48 * b30.val + u6.val := hor.symm
_ = u6.val + b30.val * 2^48 := by ring
simp only [hy6, UScalar.val_or, ht6v]
rw [hadd, hu6v]
all_goals ring
step as ⟨wn6, hwn6⟩
try simp only [spec_ok]
-- j = 7: byte 31
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
step as ⟨q7, hq7⟩
have hq7v : q7.val = 31 := by
simp [hq7, hp7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨x7, hx7⟩
simp [hb, hq7v] at hx7
step with UScalar.cast.step_spec as ⟨c7, hc7⟩
have hc7v : c7.val = b31.val := by
rw [hc7, UScalar.cast_val_eq, hx7]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s7, hsh7⟩
have hsv7 : s7.val = 56 := by
simp [hsh7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨t7, ht7⟩
have ht7v : t7.val = b31.val * 2^56 := by
rw [ht7]
simp [hsv7, hc7v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u7, hu7⟩
simp [hwn6, hw] at hu7
have hu7v : u7.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 := by rw [hu7]; exact hy6v
step as ⟨y7, hy7⟩
have hy7v : y7.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 + b31.val * 2^56 := by
have hult : u7.val < 2^56 := by rw [hu7v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u7.val) (i := 56) hult b31.val
have hadd : u7.val ||| b31.val * 2^56 = u7.val + b31.val * 2^56 := by
calc u7.val ||| b31.val * 2^56
= u7.val ||| 2^56 * b31.val := by rw [Nat.mul_comm]
_ = 2^56 * b31.val ||| u7.val := Nat.lor_comm _ _
_ = 2^56 * b31.val + u7.val := hor.symm
_ = u7.val + b31.val * 2^56 := by ring
simp only [hy7, UScalar.val_or, ht7v]
rw [hadd, hu7v]
all_goals ring
step as ⟨wn7, hwn7⟩
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
refine ⟨y7, ?_, hy7v⟩
simp [hwn4, hwn5, hwn6, hwn7, hw, Array.set_val_eq]
/-- Inner byte loop, outer index 3: word 3 accumulates bytes
24..31 little-endian; the other words are untouched.
Iterations 0..3 here; 4..7 + exit in `bytes_word_loop_tail_3`
(the 8-fold monolith exceeds the elaboration budget — METHOD 4). -/
theorem bytes_word_loop_spec_3
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w3.val = 0) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 3#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, v, w4, w5, w6, w7] ∧
v.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 + b31.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb24 : b24.val < 2^8 := by scalar_tac
have hbb25 : b25.val < 2^8 := by scalar_tac
have hbb26 : b26.val < 2^8 := by scalar_tac
have hbb27 : b27.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 0: byte 24
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
step as ⟨q0, hq0⟩
have hq0v : q0.val = 24 := by
simp [hq0, hp0]
all_goals scalar_tac
step as ⟨x0, hx0⟩
simp [hb, hq0v] at hx0
step with UScalar.cast.step_spec as ⟨c0, hc0⟩
have hc0v : c0.val = b24.val := by
rw [hc0, UScalar.cast_val_eq, hx0]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s0, hsh0⟩
have hsv0 : s0.val = 0 := by
simp [hsh0]
all_goals scalar_tac
step as ⟨t0, ht0⟩
have ht0v : t0.val = b24.val * 2^0 := by
rw [ht0]
simp [hsv0, hc0v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u0, hu0⟩
simp [hw] at hu0
have hu0v : u0.val = 0 := by rw [hu0]; exact hz
step as ⟨y0, hy0⟩
have hy0v : y0.val = b24.val := by
simp [hy0, UScalar.val_or, hu0v, ht0v]
step as ⟨wn0, hwn0⟩
try simp only [spec_ok]
-- j = 1: byte 25
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
step as ⟨q1, hq1⟩
have hq1v : q1.val = 25 := by
simp [hq1, hp1, hs0, he0]
all_goals scalar_tac
step as ⟨x1, hx1⟩
simp [hb, hq1v] at hx1
step with UScalar.cast.step_spec as ⟨c1, hc1⟩
have hc1v : c1.val = b25.val := by
rw [hc1, UScalar.cast_val_eq, hx1]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s1, hsh1⟩
have hsv1 : s1.val = 8 := by
simp [hsh1, hs0, he0]
all_goals scalar_tac
step as ⟨t1, ht1⟩
have ht1v : t1.val = b25.val * 2^8 := by
rw [ht1]
simp [hsv1, hc1v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u1, hu1⟩
simp [hwn0, hw] at hu1
have hu1v : u1.val = b24.val := by rw [hu1]; exact hy0v
step as ⟨y1, hy1⟩
have hy1v : y1.val = b24.val + b25.val * 2^8 := by
have hult : u1.val < 2^8 := by rw [hu1v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u1.val) (i := 8) hult b25.val
have hadd : u1.val ||| b25.val * 2^8 = u1.val + b25.val * 2^8 := by
calc u1.val ||| b25.val * 2^8
= u1.val ||| 2^8 * b25.val := by rw [Nat.mul_comm]
_ = 2^8 * b25.val ||| u1.val := Nat.lor_comm _ _
_ = 2^8 * b25.val + u1.val := hor.symm
_ = u1.val + b25.val * 2^8 := by ring
simp only [hy1, UScalar.val_or, ht1v]
rw [hadd, hu1v]
all_goals ring
step as ⟨wn1, hwn1⟩
try simp only [spec_ok]
-- j = 2: byte 26
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
step as ⟨q2, hq2⟩
have hq2v : q2.val = 26 := by
simp [hq2, hp2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨x2, hx2⟩
simp [hb, hq2v] at hx2
step with UScalar.cast.step_spec as ⟨c2, hc2⟩
have hc2v : c2.val = b26.val := by
rw [hc2, UScalar.cast_val_eq, hx2]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s2, hsh2⟩
have hsv2 : s2.val = 16 := by
simp [hsh2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨t2, ht2⟩
have ht2v : t2.val = b26.val * 2^16 := by
rw [ht2]
simp [hsv2, hc2v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u2, hu2⟩
simp [hwn1, hw] at hu2
have hu2v : u2.val = b24.val + b25.val * 2^8 := by rw [hu2]; exact hy1v
step as ⟨y2, hy2⟩
have hy2v : y2.val = b24.val + b25.val * 2^8 + b26.val * 2^16 := by
have hult : u2.val < 2^16 := by rw [hu2v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u2.val) (i := 16) hult b26.val
have hadd : u2.val ||| b26.val * 2^16 = u2.val + b26.val * 2^16 := by
calc u2.val ||| b26.val * 2^16
= u2.val ||| 2^16 * b26.val := by rw [Nat.mul_comm]
_ = 2^16 * b26.val ||| u2.val := Nat.lor_comm _ _
_ = 2^16 * b26.val + u2.val := hor.symm
_ = u2.val + b26.val * 2^16 := by ring
simp only [hy2, UScalar.val_or, ht2v]
rw [hadd, hu2v]
all_goals ring
step as ⟨wn2, hwn2⟩
try simp only [spec_ok]
-- j = 3: byte 27
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
step as ⟨q3, hq3⟩
have hq3v : q3.val = 27 := by
simp [hq3, hp3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨x3, hx3⟩
simp [hb, hq3v] at hx3
step with UScalar.cast.step_spec as ⟨c3, hc3⟩
have hc3v : c3.val = b27.val := by
rw [hc3, UScalar.cast_val_eq, hx3]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s3, hsh3⟩
have hsv3 : s3.val = 24 := by
simp [hsh3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨t3, ht3⟩
have ht3v : t3.val = b27.val * 2^24 := by
rw [ht3]
simp [hsv3, hc3v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u3, hu3⟩
simp [hwn2, hw] at hu3
have hu3v : u3.val = b24.val + b25.val * 2^8 + b26.val * 2^16 := by rw [hu3]; exact hy2v
step as ⟨y3, hy3⟩
have hy3v : y3.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 := by
have hult : u3.val < 2^24 := by rw [hu3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u3.val) (i := 24) hult b27.val
have hadd : u3.val ||| b27.val * 2^24 = u3.val + b27.val * 2^24 := by
calc u3.val ||| b27.val * 2^24
= u3.val ||| 2^24 * b27.val := by rw [Nat.mul_comm]
_ = 2^24 * b27.val ||| u3.val := Nat.lor_comm _ _
_ = 2^24 * b27.val + u3.val := hor.symm
_ = u3.val + b27.val * 2^24 := by ring
simp only [hy3, UScalar.val_or, ht3v]
rw [hadd, hu3v]
all_goals ring
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 3#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, v, w4, w5, w6, w7] ∧
v.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 + b31.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, y3, w4, w5, w6, w7] := by
simp [hwn0, hwn1, hwn2, hwn3, hw, Array.set_val_eq]
have hst3 : iter3.start.val = 4 := by
simp [hs3, hs2, hs1, hs0]
all_goals scalar_tac
have hend3 : iter3.«end» = 8#usize := by
simp [he3, he2, he1, he0]
exact bytes_word_loop_tail_3 bytes wn3 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
w0 w1 w2 y3 w4 w5 w6 w7 iter3 hb hwn3l hst3 hend3 hy3v
/-- Inner byte loop for word 4, iterations 4..7 + exit: continues the
accumulation from the mid-state (bytes 32..35 absorbed). -/
theorem bytes_word_loop_tail_4
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(iter : core.ops.range.Range Std.Usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w4.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 4#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, v, w5, w6, w7] ∧
v.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 + b39.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb32 : b32.val < 2^8 := by scalar_tac
have hbb33 : b33.val < 2^8 := by scalar_tac
have hbb34 : b34.val < 2^8 := by scalar_tac
have hbb35 : b35.val < 2^8 := by scalar_tac
have hbb36 : b36.val < 2^8 := by scalar_tac
have hbb37 : b37.val < 2^8 := by scalar_tac
have hbb38 : b38.val < 2^8 := by scalar_tac
have hbb39 : b39.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 4: byte 36
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
step as ⟨q4, hq4⟩
have hq4v : q4.val = 36 := by
simp [hq4, hp4, hst]
all_goals scalar_tac
step as ⟨x4, hx4⟩
simp [hb, hq4v] at hx4
step with UScalar.cast.step_spec as ⟨c4, hc4⟩
have hc4v : c4.val = b36.val := by
rw [hc4, UScalar.cast_val_eq, hx4]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s4, hsh4⟩
have hsv4 : s4.val = 32 := by
simp [hsh4, hst]
all_goals scalar_tac
step as ⟨t4, ht4⟩
have ht4v : t4.val = b36.val * 2^32 := by
rw [ht4]
simp [hsv4, hc4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u4, hu4⟩
simp [hw] at hu4
have hu4v : u4.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 := by rw [hu4]; exact hacc
step as ⟨y4, hy4⟩
have hy4v : y4.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 := by
have hult : u4.val < 2^32 := by rw [hu4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u4.val) (i := 32) hult b36.val
have hadd : u4.val ||| b36.val * 2^32 = u4.val + b36.val * 2^32 := by
calc u4.val ||| b36.val * 2^32
= u4.val ||| 2^32 * b36.val := by rw [Nat.mul_comm]
_ = 2^32 * b36.val ||| u4.val := Nat.lor_comm _ _
_ = 2^32 * b36.val + u4.val := hor.symm
_ = u4.val + b36.val * 2^32 := by ring
simp only [hy4, UScalar.val_or, ht4v]
rw [hadd, hu4v]
all_goals ring
step as ⟨wn4, hwn4⟩
try simp only [spec_ok]
-- j = 5: byte 37
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
step as ⟨q5, hq5⟩
have hq5v : q5.val = 37 := by
simp [hq5, hp5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨x5, hx5⟩
simp [hb, hq5v] at hx5
step with UScalar.cast.step_spec as ⟨c5, hc5⟩
have hc5v : c5.val = b37.val := by
rw [hc5, UScalar.cast_val_eq, hx5]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s5, hsh5⟩
have hsv5 : s5.val = 40 := by
simp [hsh5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨t5, ht5⟩
have ht5v : t5.val = b37.val * 2^40 := by
rw [ht5]
simp [hsv5, hc5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u5, hu5⟩
simp [hwn4, hw] at hu5
have hu5v : u5.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 := by rw [hu5]; exact hy4v
step as ⟨y5, hy5⟩
have hy5v : y5.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 := by
have hult : u5.val < 2^40 := by rw [hu5v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u5.val) (i := 40) hult b37.val
have hadd : u5.val ||| b37.val * 2^40 = u5.val + b37.val * 2^40 := by
calc u5.val ||| b37.val * 2^40
= u5.val ||| 2^40 * b37.val := by rw [Nat.mul_comm]
_ = 2^40 * b37.val ||| u5.val := Nat.lor_comm _ _
_ = 2^40 * b37.val + u5.val := hor.symm
_ = u5.val + b37.val * 2^40 := by ring
simp only [hy5, UScalar.val_or, ht5v]
rw [hadd, hu5v]
all_goals ring
step as ⟨wn5, hwn5⟩
try simp only [spec_ok]
-- j = 6: byte 38
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
step as ⟨q6, hq6⟩
have hq6v : q6.val = 38 := by
simp [hq6, hp6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨x6, hx6⟩
simp [hb, hq6v] at hx6
step with UScalar.cast.step_spec as ⟨c6, hc6⟩
have hc6v : c6.val = b38.val := by
rw [hc6, UScalar.cast_val_eq, hx6]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s6, hsh6⟩
have hsv6 : s6.val = 48 := by
simp [hsh6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨t6, ht6⟩
have ht6v : t6.val = b38.val * 2^48 := by
rw [ht6]
simp [hsv6, hc6v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u6, hu6⟩
simp [hwn5, hw] at hu6
have hu6v : u6.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 := by rw [hu6]; exact hy5v
step as ⟨y6, hy6⟩
have hy6v : y6.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 := by
have hult : u6.val < 2^48 := by rw [hu6v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u6.val) (i := 48) hult b38.val
have hadd : u6.val ||| b38.val * 2^48 = u6.val + b38.val * 2^48 := by
calc u6.val ||| b38.val * 2^48
= u6.val ||| 2^48 * b38.val := by rw [Nat.mul_comm]
_ = 2^48 * b38.val ||| u6.val := Nat.lor_comm _ _
_ = 2^48 * b38.val + u6.val := hor.symm
_ = u6.val + b38.val * 2^48 := by ring
simp only [hy6, UScalar.val_or, ht6v]
rw [hadd, hu6v]
all_goals ring
step as ⟨wn6, hwn6⟩
try simp only [spec_ok]
-- j = 7: byte 39
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
step as ⟨q7, hq7⟩
have hq7v : q7.val = 39 := by
simp [hq7, hp7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨x7, hx7⟩
simp [hb, hq7v] at hx7
step with UScalar.cast.step_spec as ⟨c7, hc7⟩
have hc7v : c7.val = b39.val := by
rw [hc7, UScalar.cast_val_eq, hx7]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s7, hsh7⟩
have hsv7 : s7.val = 56 := by
simp [hsh7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨t7, ht7⟩
have ht7v : t7.val = b39.val * 2^56 := by
rw [ht7]
simp [hsv7, hc7v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u7, hu7⟩
simp [hwn6, hw] at hu7
have hu7v : u7.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 := by rw [hu7]; exact hy6v
step as ⟨y7, hy7⟩
have hy7v : y7.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 + b39.val * 2^56 := by
have hult : u7.val < 2^56 := by rw [hu7v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u7.val) (i := 56) hult b39.val
have hadd : u7.val ||| b39.val * 2^56 = u7.val + b39.val * 2^56 := by
calc u7.val ||| b39.val * 2^56
= u7.val ||| 2^56 * b39.val := by rw [Nat.mul_comm]
_ = 2^56 * b39.val ||| u7.val := Nat.lor_comm _ _
_ = 2^56 * b39.val + u7.val := hor.symm
_ = u7.val + b39.val * 2^56 := by ring
simp only [hy7, UScalar.val_or, ht7v]
rw [hadd, hu7v]
all_goals ring
step as ⟨wn7, hwn7⟩
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
refine ⟨y7, ?_, hy7v⟩
simp [hwn4, hwn5, hwn6, hwn7, hw, Array.set_val_eq]
/-- Inner byte loop, outer index 4: word 4 accumulates bytes
32..39 little-endian; the other words are untouched.
Iterations 0..3 here; 4..7 + exit in `bytes_word_loop_tail_4`
(the 8-fold monolith exceeds the elaboration budget — METHOD 4). -/
theorem bytes_word_loop_spec_4
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w4.val = 0) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 4#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, v, w5, w6, w7] ∧
v.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 + b39.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb32 : b32.val < 2^8 := by scalar_tac
have hbb33 : b33.val < 2^8 := by scalar_tac
have hbb34 : b34.val < 2^8 := by scalar_tac
have hbb35 : b35.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 0: byte 32
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
step as ⟨q0, hq0⟩
have hq0v : q0.val = 32 := by
simp [hq0, hp0]
all_goals scalar_tac
step as ⟨x0, hx0⟩
simp [hb, hq0v] at hx0
step with UScalar.cast.step_spec as ⟨c0, hc0⟩
have hc0v : c0.val = b32.val := by
rw [hc0, UScalar.cast_val_eq, hx0]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s0, hsh0⟩
have hsv0 : s0.val = 0 := by
simp [hsh0]
all_goals scalar_tac
step as ⟨t0, ht0⟩
have ht0v : t0.val = b32.val * 2^0 := by
rw [ht0]
simp [hsv0, hc0v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u0, hu0⟩
simp [hw] at hu0
have hu0v : u0.val = 0 := by rw [hu0]; exact hz
step as ⟨y0, hy0⟩
have hy0v : y0.val = b32.val := by
simp [hy0, UScalar.val_or, hu0v, ht0v]
step as ⟨wn0, hwn0⟩
try simp only [spec_ok]
-- j = 1: byte 33
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
step as ⟨q1, hq1⟩
have hq1v : q1.val = 33 := by
simp [hq1, hp1, hs0, he0]
all_goals scalar_tac
step as ⟨x1, hx1⟩
simp [hb, hq1v] at hx1
step with UScalar.cast.step_spec as ⟨c1, hc1⟩
have hc1v : c1.val = b33.val := by
rw [hc1, UScalar.cast_val_eq, hx1]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s1, hsh1⟩
have hsv1 : s1.val = 8 := by
simp [hsh1, hs0, he0]
all_goals scalar_tac
step as ⟨t1, ht1⟩
have ht1v : t1.val = b33.val * 2^8 := by
rw [ht1]
simp [hsv1, hc1v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u1, hu1⟩
simp [hwn0, hw] at hu1
have hu1v : u1.val = b32.val := by rw [hu1]; exact hy0v
step as ⟨y1, hy1⟩
have hy1v : y1.val = b32.val + b33.val * 2^8 := by
have hult : u1.val < 2^8 := by rw [hu1v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u1.val) (i := 8) hult b33.val
have hadd : u1.val ||| b33.val * 2^8 = u1.val + b33.val * 2^8 := by
calc u1.val ||| b33.val * 2^8
= u1.val ||| 2^8 * b33.val := by rw [Nat.mul_comm]
_ = 2^8 * b33.val ||| u1.val := Nat.lor_comm _ _
_ = 2^8 * b33.val + u1.val := hor.symm
_ = u1.val + b33.val * 2^8 := by ring
simp only [hy1, UScalar.val_or, ht1v]
rw [hadd, hu1v]
all_goals ring
step as ⟨wn1, hwn1⟩
try simp only [spec_ok]
-- j = 2: byte 34
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
step as ⟨q2, hq2⟩
have hq2v : q2.val = 34 := by
simp [hq2, hp2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨x2, hx2⟩
simp [hb, hq2v] at hx2
step with UScalar.cast.step_spec as ⟨c2, hc2⟩
have hc2v : c2.val = b34.val := by
rw [hc2, UScalar.cast_val_eq, hx2]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s2, hsh2⟩
have hsv2 : s2.val = 16 := by
simp [hsh2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨t2, ht2⟩
have ht2v : t2.val = b34.val * 2^16 := by
rw [ht2]
simp [hsv2, hc2v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u2, hu2⟩
simp [hwn1, hw] at hu2
have hu2v : u2.val = b32.val + b33.val * 2^8 := by rw [hu2]; exact hy1v
step as ⟨y2, hy2⟩
have hy2v : y2.val = b32.val + b33.val * 2^8 + b34.val * 2^16 := by
have hult : u2.val < 2^16 := by rw [hu2v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u2.val) (i := 16) hult b34.val
have hadd : u2.val ||| b34.val * 2^16 = u2.val + b34.val * 2^16 := by
calc u2.val ||| b34.val * 2^16
= u2.val ||| 2^16 * b34.val := by rw [Nat.mul_comm]
_ = 2^16 * b34.val ||| u2.val := Nat.lor_comm _ _
_ = 2^16 * b34.val + u2.val := hor.symm
_ = u2.val + b34.val * 2^16 := by ring
simp only [hy2, UScalar.val_or, ht2v]
rw [hadd, hu2v]
all_goals ring
step as ⟨wn2, hwn2⟩
try simp only [spec_ok]
-- j = 3: byte 35
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
step as ⟨q3, hq3⟩
have hq3v : q3.val = 35 := by
simp [hq3, hp3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨x3, hx3⟩
simp [hb, hq3v] at hx3
step with UScalar.cast.step_spec as ⟨c3, hc3⟩
have hc3v : c3.val = b35.val := by
rw [hc3, UScalar.cast_val_eq, hx3]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s3, hsh3⟩
have hsv3 : s3.val = 24 := by
simp [hsh3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨t3, ht3⟩
have ht3v : t3.val = b35.val * 2^24 := by
rw [ht3]
simp [hsv3, hc3v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u3, hu3⟩
simp [hwn2, hw] at hu3
have hu3v : u3.val = b32.val + b33.val * 2^8 + b34.val * 2^16 := by rw [hu3]; exact hy2v
step as ⟨y3, hy3⟩
have hy3v : y3.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 := by
have hult : u3.val < 2^24 := by rw [hu3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u3.val) (i := 24) hult b35.val
have hadd : u3.val ||| b35.val * 2^24 = u3.val + b35.val * 2^24 := by
calc u3.val ||| b35.val * 2^24
= u3.val ||| 2^24 * b35.val := by rw [Nat.mul_comm]
_ = 2^24 * b35.val ||| u3.val := Nat.lor_comm _ _
_ = 2^24 * b35.val + u3.val := hor.symm
_ = u3.val + b35.val * 2^24 := by ring
simp only [hy3, UScalar.val_or, ht3v]
rw [hadd, hu3v]
all_goals ring
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 4#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, v, w5, w6, w7] ∧
v.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 + b39.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, w3, y3, w5, w6, w7] := by
simp [hwn0, hwn1, hwn2, hwn3, hw, Array.set_val_eq]
have hst3 : iter3.start.val = 4 := by
simp [hs3, hs2, hs1, hs0]
all_goals scalar_tac
have hend3 : iter3.«end» = 8#usize := by
simp [he3, he2, he1, he0]
exact bytes_word_loop_tail_4 bytes wn3 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
w0 w1 w2 w3 y3 w5 w6 w7 iter3 hb hwn3l hst3 hend3 hy3v
/-- Inner byte loop for word 5, iterations 4..7 + exit: continues the
accumulation from the mid-state (bytes 40..43 absorbed). -/
theorem bytes_word_loop_tail_5
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(iter : core.ops.range.Range Std.Usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w5.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 5#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, v, w6, w7] ∧
v.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 + b47.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb40 : b40.val < 2^8 := by scalar_tac
have hbb41 : b41.val < 2^8 := by scalar_tac
have hbb42 : b42.val < 2^8 := by scalar_tac
have hbb43 : b43.val < 2^8 := by scalar_tac
have hbb44 : b44.val < 2^8 := by scalar_tac
have hbb45 : b45.val < 2^8 := by scalar_tac
have hbb46 : b46.val < 2^8 := by scalar_tac
have hbb47 : b47.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 4: byte 44
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
step as ⟨q4, hq4⟩
have hq4v : q4.val = 44 := by
simp [hq4, hp4, hst]
all_goals scalar_tac
step as ⟨x4, hx4⟩
simp [hb, hq4v] at hx4
step with UScalar.cast.step_spec as ⟨c4, hc4⟩
have hc4v : c4.val = b44.val := by
rw [hc4, UScalar.cast_val_eq, hx4]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s4, hsh4⟩
have hsv4 : s4.val = 32 := by
simp [hsh4, hst]
all_goals scalar_tac
step as ⟨t4, ht4⟩
have ht4v : t4.val = b44.val * 2^32 := by
rw [ht4]
simp [hsv4, hc4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u4, hu4⟩
simp [hw] at hu4
have hu4v : u4.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 := by rw [hu4]; exact hacc
step as ⟨y4, hy4⟩
have hy4v : y4.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 := by
have hult : u4.val < 2^32 := by rw [hu4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u4.val) (i := 32) hult b44.val
have hadd : u4.val ||| b44.val * 2^32 = u4.val + b44.val * 2^32 := by
calc u4.val ||| b44.val * 2^32
= u4.val ||| 2^32 * b44.val := by rw [Nat.mul_comm]
_ = 2^32 * b44.val ||| u4.val := Nat.lor_comm _ _
_ = 2^32 * b44.val + u4.val := hor.symm
_ = u4.val + b44.val * 2^32 := by ring
simp only [hy4, UScalar.val_or, ht4v]
rw [hadd, hu4v]
all_goals ring
step as ⟨wn4, hwn4⟩
try simp only [spec_ok]
-- j = 5: byte 45
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
step as ⟨q5, hq5⟩
have hq5v : q5.val = 45 := by
simp [hq5, hp5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨x5, hx5⟩
simp [hb, hq5v] at hx5
step with UScalar.cast.step_spec as ⟨c5, hc5⟩
have hc5v : c5.val = b45.val := by
rw [hc5, UScalar.cast_val_eq, hx5]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s5, hsh5⟩
have hsv5 : s5.val = 40 := by
simp [hsh5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨t5, ht5⟩
have ht5v : t5.val = b45.val * 2^40 := by
rw [ht5]
simp [hsv5, hc5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u5, hu5⟩
simp [hwn4, hw] at hu5
have hu5v : u5.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 := by rw [hu5]; exact hy4v
step as ⟨y5, hy5⟩
have hy5v : y5.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 := by
have hult : u5.val < 2^40 := by rw [hu5v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u5.val) (i := 40) hult b45.val
have hadd : u5.val ||| b45.val * 2^40 = u5.val + b45.val * 2^40 := by
calc u5.val ||| b45.val * 2^40
= u5.val ||| 2^40 * b45.val := by rw [Nat.mul_comm]
_ = 2^40 * b45.val ||| u5.val := Nat.lor_comm _ _
_ = 2^40 * b45.val + u5.val := hor.symm
_ = u5.val + b45.val * 2^40 := by ring
simp only [hy5, UScalar.val_or, ht5v]
rw [hadd, hu5v]
all_goals ring
step as ⟨wn5, hwn5⟩
try simp only [spec_ok]
-- j = 6: byte 46
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
step as ⟨q6, hq6⟩
have hq6v : q6.val = 46 := by
simp [hq6, hp6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨x6, hx6⟩
simp [hb, hq6v] at hx6
step with UScalar.cast.step_spec as ⟨c6, hc6⟩
have hc6v : c6.val = b46.val := by
rw [hc6, UScalar.cast_val_eq, hx6]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s6, hsh6⟩
have hsv6 : s6.val = 48 := by
simp [hsh6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨t6, ht6⟩
have ht6v : t6.val = b46.val * 2^48 := by
rw [ht6]
simp [hsv6, hc6v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u6, hu6⟩
simp [hwn5, hw] at hu6
have hu6v : u6.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 := by rw [hu6]; exact hy5v
step as ⟨y6, hy6⟩
have hy6v : y6.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 := by
have hult : u6.val < 2^48 := by rw [hu6v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u6.val) (i := 48) hult b46.val
have hadd : u6.val ||| b46.val * 2^48 = u6.val + b46.val * 2^48 := by
calc u6.val ||| b46.val * 2^48
= u6.val ||| 2^48 * b46.val := by rw [Nat.mul_comm]
_ = 2^48 * b46.val ||| u6.val := Nat.lor_comm _ _
_ = 2^48 * b46.val + u6.val := hor.symm
_ = u6.val + b46.val * 2^48 := by ring
simp only [hy6, UScalar.val_or, ht6v]
rw [hadd, hu6v]
all_goals ring
step as ⟨wn6, hwn6⟩
try simp only [spec_ok]
-- j = 7: byte 47
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
step as ⟨q7, hq7⟩
have hq7v : q7.val = 47 := by
simp [hq7, hp7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨x7, hx7⟩
simp [hb, hq7v] at hx7
step with UScalar.cast.step_spec as ⟨c7, hc7⟩
have hc7v : c7.val = b47.val := by
rw [hc7, UScalar.cast_val_eq, hx7]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s7, hsh7⟩
have hsv7 : s7.val = 56 := by
simp [hsh7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨t7, ht7⟩
have ht7v : t7.val = b47.val * 2^56 := by
rw [ht7]
simp [hsv7, hc7v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u7, hu7⟩
simp [hwn6, hw] at hu7
have hu7v : u7.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 := by rw [hu7]; exact hy6v
step as ⟨y7, hy7⟩
have hy7v : y7.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 + b47.val * 2^56 := by
have hult : u7.val < 2^56 := by rw [hu7v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u7.val) (i := 56) hult b47.val
have hadd : u7.val ||| b47.val * 2^56 = u7.val + b47.val * 2^56 := by
calc u7.val ||| b47.val * 2^56
= u7.val ||| 2^56 * b47.val := by rw [Nat.mul_comm]
_ = 2^56 * b47.val ||| u7.val := Nat.lor_comm _ _
_ = 2^56 * b47.val + u7.val := hor.symm
_ = u7.val + b47.val * 2^56 := by ring
simp only [hy7, UScalar.val_or, ht7v]
rw [hadd, hu7v]
all_goals ring
step as ⟨wn7, hwn7⟩
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
refine ⟨y7, ?_, hy7v⟩
simp [hwn4, hwn5, hwn6, hwn7, hw, Array.set_val_eq]
/-- Inner byte loop, outer index 5: word 5 accumulates bytes
40..47 little-endian; the other words are untouched.
Iterations 0..3 here; 4..7 + exit in `bytes_word_loop_tail_5`
(the 8-fold monolith exceeds the elaboration budget — METHOD 4). -/
theorem bytes_word_loop_spec_5
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w5.val = 0) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 5#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, v, w6, w7] ∧
v.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 + b47.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb40 : b40.val < 2^8 := by scalar_tac
have hbb41 : b41.val < 2^8 := by scalar_tac
have hbb42 : b42.val < 2^8 := by scalar_tac
have hbb43 : b43.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 0: byte 40
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
step as ⟨q0, hq0⟩
have hq0v : q0.val = 40 := by
simp [hq0, hp0]
all_goals scalar_tac
step as ⟨x0, hx0⟩
simp [hb, hq0v] at hx0
step with UScalar.cast.step_spec as ⟨c0, hc0⟩
have hc0v : c0.val = b40.val := by
rw [hc0, UScalar.cast_val_eq, hx0]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s0, hsh0⟩
have hsv0 : s0.val = 0 := by
simp [hsh0]
all_goals scalar_tac
step as ⟨t0, ht0⟩
have ht0v : t0.val = b40.val * 2^0 := by
rw [ht0]
simp [hsv0, hc0v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u0, hu0⟩
simp [hw] at hu0
have hu0v : u0.val = 0 := by rw [hu0]; exact hz
step as ⟨y0, hy0⟩
have hy0v : y0.val = b40.val := by
simp [hy0, UScalar.val_or, hu0v, ht0v]
step as ⟨wn0, hwn0⟩
try simp only [spec_ok]
-- j = 1: byte 41
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
step as ⟨q1, hq1⟩
have hq1v : q1.val = 41 := by
simp [hq1, hp1, hs0, he0]
all_goals scalar_tac
step as ⟨x1, hx1⟩
simp [hb, hq1v] at hx1
step with UScalar.cast.step_spec as ⟨c1, hc1⟩
have hc1v : c1.val = b41.val := by
rw [hc1, UScalar.cast_val_eq, hx1]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s1, hsh1⟩
have hsv1 : s1.val = 8 := by
simp [hsh1, hs0, he0]
all_goals scalar_tac
step as ⟨t1, ht1⟩
have ht1v : t1.val = b41.val * 2^8 := by
rw [ht1]
simp [hsv1, hc1v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u1, hu1⟩
simp [hwn0, hw] at hu1
have hu1v : u1.val = b40.val := by rw [hu1]; exact hy0v
step as ⟨y1, hy1⟩
have hy1v : y1.val = b40.val + b41.val * 2^8 := by
have hult : u1.val < 2^8 := by rw [hu1v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u1.val) (i := 8) hult b41.val
have hadd : u1.val ||| b41.val * 2^8 = u1.val + b41.val * 2^8 := by
calc u1.val ||| b41.val * 2^8
= u1.val ||| 2^8 * b41.val := by rw [Nat.mul_comm]
_ = 2^8 * b41.val ||| u1.val := Nat.lor_comm _ _
_ = 2^8 * b41.val + u1.val := hor.symm
_ = u1.val + b41.val * 2^8 := by ring
simp only [hy1, UScalar.val_or, ht1v]
rw [hadd, hu1v]
all_goals ring
step as ⟨wn1, hwn1⟩
try simp only [spec_ok]
-- j = 2: byte 42
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
step as ⟨q2, hq2⟩
have hq2v : q2.val = 42 := by
simp [hq2, hp2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨x2, hx2⟩
simp [hb, hq2v] at hx2
step with UScalar.cast.step_spec as ⟨c2, hc2⟩
have hc2v : c2.val = b42.val := by
rw [hc2, UScalar.cast_val_eq, hx2]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s2, hsh2⟩
have hsv2 : s2.val = 16 := by
simp [hsh2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨t2, ht2⟩
have ht2v : t2.val = b42.val * 2^16 := by
rw [ht2]
simp [hsv2, hc2v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u2, hu2⟩
simp [hwn1, hw] at hu2
have hu2v : u2.val = b40.val + b41.val * 2^8 := by rw [hu2]; exact hy1v
step as ⟨y2, hy2⟩
have hy2v : y2.val = b40.val + b41.val * 2^8 + b42.val * 2^16 := by
have hult : u2.val < 2^16 := by rw [hu2v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u2.val) (i := 16) hult b42.val
have hadd : u2.val ||| b42.val * 2^16 = u2.val + b42.val * 2^16 := by
calc u2.val ||| b42.val * 2^16
= u2.val ||| 2^16 * b42.val := by rw [Nat.mul_comm]
_ = 2^16 * b42.val ||| u2.val := Nat.lor_comm _ _
_ = 2^16 * b42.val + u2.val := hor.symm
_ = u2.val + b42.val * 2^16 := by ring
simp only [hy2, UScalar.val_or, ht2v]
rw [hadd, hu2v]
all_goals ring
step as ⟨wn2, hwn2⟩
try simp only [spec_ok]
-- j = 3: byte 43
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
step as ⟨q3, hq3⟩
have hq3v : q3.val = 43 := by
simp [hq3, hp3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨x3, hx3⟩
simp [hb, hq3v] at hx3
step with UScalar.cast.step_spec as ⟨c3, hc3⟩
have hc3v : c3.val = b43.val := by
rw [hc3, UScalar.cast_val_eq, hx3]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s3, hsh3⟩
have hsv3 : s3.val = 24 := by
simp [hsh3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨t3, ht3⟩
have ht3v : t3.val = b43.val * 2^24 := by
rw [ht3]
simp [hsv3, hc3v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u3, hu3⟩
simp [hwn2, hw] at hu3
have hu3v : u3.val = b40.val + b41.val * 2^8 + b42.val * 2^16 := by rw [hu3]; exact hy2v
step as ⟨y3, hy3⟩
have hy3v : y3.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 := by
have hult : u3.val < 2^24 := by rw [hu3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u3.val) (i := 24) hult b43.val
have hadd : u3.val ||| b43.val * 2^24 = u3.val + b43.val * 2^24 := by
calc u3.val ||| b43.val * 2^24
= u3.val ||| 2^24 * b43.val := by rw [Nat.mul_comm]
_ = 2^24 * b43.val ||| u3.val := Nat.lor_comm _ _
_ = 2^24 * b43.val + u3.val := hor.symm
_ = u3.val + b43.val * 2^24 := by ring
simp only [hy3, UScalar.val_or, ht3v]
rw [hadd, hu3v]
all_goals ring
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 5#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, v, w6, w7] ∧
v.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 + b47.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, w3, w4, y3, w6, w7] := by
simp [hwn0, hwn1, hwn2, hwn3, hw, Array.set_val_eq]
have hst3 : iter3.start.val = 4 := by
simp [hs3, hs2, hs1, hs0]
all_goals scalar_tac
have hend3 : iter3.«end» = 8#usize := by
simp [he3, he2, he1, he0]
exact bytes_word_loop_tail_5 bytes wn3 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
w0 w1 w2 w3 w4 y3 w6 w7 iter3 hb hwn3l hst3 hend3 hy3v
/-- Inner byte loop for word 6, iterations 4..7 + exit: continues the
accumulation from the mid-state (bytes 48..51 absorbed). -/
theorem bytes_word_loop_tail_6
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(iter : core.ops.range.Range Std.Usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w6.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 6#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, v, w7] ∧
v.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb48 : b48.val < 2^8 := by scalar_tac
have hbb49 : b49.val < 2^8 := by scalar_tac
have hbb50 : b50.val < 2^8 := by scalar_tac
have hbb51 : b51.val < 2^8 := by scalar_tac
have hbb52 : b52.val < 2^8 := by scalar_tac
have hbb53 : b53.val < 2^8 := by scalar_tac
have hbb54 : b54.val < 2^8 := by scalar_tac
have hbb55 : b55.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 4: byte 52
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
step as ⟨q4, hq4⟩
have hq4v : q4.val = 52 := by
simp [hq4, hp4, hst]
all_goals scalar_tac
step as ⟨x4, hx4⟩
simp [hb, hq4v] at hx4
step with UScalar.cast.step_spec as ⟨c4, hc4⟩
have hc4v : c4.val = b52.val := by
rw [hc4, UScalar.cast_val_eq, hx4]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s4, hsh4⟩
have hsv4 : s4.val = 32 := by
simp [hsh4, hst]
all_goals scalar_tac
step as ⟨t4, ht4⟩
have ht4v : t4.val = b52.val * 2^32 := by
rw [ht4]
simp [hsv4, hc4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u4, hu4⟩
simp [hw] at hu4
have hu4v : u4.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 := by rw [hu4]; exact hacc
step as ⟨y4, hy4⟩
have hy4v : y4.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 := by
have hult : u4.val < 2^32 := by rw [hu4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u4.val) (i := 32) hult b52.val
have hadd : u4.val ||| b52.val * 2^32 = u4.val + b52.val * 2^32 := by
calc u4.val ||| b52.val * 2^32
= u4.val ||| 2^32 * b52.val := by rw [Nat.mul_comm]
_ = 2^32 * b52.val ||| u4.val := Nat.lor_comm _ _
_ = 2^32 * b52.val + u4.val := hor.symm
_ = u4.val + b52.val * 2^32 := by ring
simp only [hy4, UScalar.val_or, ht4v]
rw [hadd, hu4v]
all_goals ring
step as ⟨wn4, hwn4⟩
try simp only [spec_ok]
-- j = 5: byte 53
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
step as ⟨q5, hq5⟩
have hq5v : q5.val = 53 := by
simp [hq5, hp5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨x5, hx5⟩
simp [hb, hq5v] at hx5
step with UScalar.cast.step_spec as ⟨c5, hc5⟩
have hc5v : c5.val = b53.val := by
rw [hc5, UScalar.cast_val_eq, hx5]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s5, hsh5⟩
have hsv5 : s5.val = 40 := by
simp [hsh5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨t5, ht5⟩
have ht5v : t5.val = b53.val * 2^40 := by
rw [ht5]
simp [hsv5, hc5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u5, hu5⟩
simp [hwn4, hw] at hu5
have hu5v : u5.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 := by rw [hu5]; exact hy4v
step as ⟨y5, hy5⟩
have hy5v : y5.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 := by
have hult : u5.val < 2^40 := by rw [hu5v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u5.val) (i := 40) hult b53.val
have hadd : u5.val ||| b53.val * 2^40 = u5.val + b53.val * 2^40 := by
calc u5.val ||| b53.val * 2^40
= u5.val ||| 2^40 * b53.val := by rw [Nat.mul_comm]
_ = 2^40 * b53.val ||| u5.val := Nat.lor_comm _ _
_ = 2^40 * b53.val + u5.val := hor.symm
_ = u5.val + b53.val * 2^40 := by ring
simp only [hy5, UScalar.val_or, ht5v]
rw [hadd, hu5v]
all_goals ring
step as ⟨wn5, hwn5⟩
try simp only [spec_ok]
-- j = 6: byte 54
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
step as ⟨q6, hq6⟩
have hq6v : q6.val = 54 := by
simp [hq6, hp6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨x6, hx6⟩
simp [hb, hq6v] at hx6
step with UScalar.cast.step_spec as ⟨c6, hc6⟩
have hc6v : c6.val = b54.val := by
rw [hc6, UScalar.cast_val_eq, hx6]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s6, hsh6⟩
have hsv6 : s6.val = 48 := by
simp [hsh6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨t6, ht6⟩
have ht6v : t6.val = b54.val * 2^48 := by
rw [ht6]
simp [hsv6, hc6v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u6, hu6⟩
simp [hwn5, hw] at hu6
have hu6v : u6.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 := by rw [hu6]; exact hy5v
step as ⟨y6, hy6⟩
have hy6v : y6.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 := by
have hult : u6.val < 2^48 := by rw [hu6v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u6.val) (i := 48) hult b54.val
have hadd : u6.val ||| b54.val * 2^48 = u6.val + b54.val * 2^48 := by
calc u6.val ||| b54.val * 2^48
= u6.val ||| 2^48 * b54.val := by rw [Nat.mul_comm]
_ = 2^48 * b54.val ||| u6.val := Nat.lor_comm _ _
_ = 2^48 * b54.val + u6.val := hor.symm
_ = u6.val + b54.val * 2^48 := by ring
simp only [hy6, UScalar.val_or, ht6v]
rw [hadd, hu6v]
all_goals ring
step as ⟨wn6, hwn6⟩
try simp only [spec_ok]
-- j = 7: byte 55
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
step as ⟨q7, hq7⟩
have hq7v : q7.val = 55 := by
simp [hq7, hp7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨x7, hx7⟩
simp [hb, hq7v] at hx7
step with UScalar.cast.step_spec as ⟨c7, hc7⟩
have hc7v : c7.val = b55.val := by
rw [hc7, UScalar.cast_val_eq, hx7]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s7, hsh7⟩
have hsv7 : s7.val = 56 := by
simp [hsh7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨t7, ht7⟩
have ht7v : t7.val = b55.val * 2^56 := by
rw [ht7]
simp [hsv7, hc7v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u7, hu7⟩
simp [hwn6, hw] at hu7
have hu7v : u7.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 := by rw [hu7]; exact hy6v
step as ⟨y7, hy7⟩
have hy7v : y7.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 := by
have hult : u7.val < 2^56 := by rw [hu7v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u7.val) (i := 56) hult b55.val
have hadd : u7.val ||| b55.val * 2^56 = u7.val + b55.val * 2^56 := by
calc u7.val ||| b55.val * 2^56
= u7.val ||| 2^56 * b55.val := by rw [Nat.mul_comm]
_ = 2^56 * b55.val ||| u7.val := Nat.lor_comm _ _
_ = 2^56 * b55.val + u7.val := hor.symm
_ = u7.val + b55.val * 2^56 := by ring
simp only [hy7, UScalar.val_or, ht7v]
rw [hadd, hu7v]
all_goals ring
step as ⟨wn7, hwn7⟩
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
refine ⟨y7, ?_, hy7v⟩
simp [hwn4, hwn5, hwn6, hwn7, hw, Array.set_val_eq]
/-- Inner byte loop, outer index 6: word 6 accumulates bytes
48..55 little-endian; the other words are untouched.
Iterations 0..3 here; 4..7 + exit in `bytes_word_loop_tail_6`
(the 8-fold monolith exceeds the elaboration budget — METHOD 4). -/
theorem bytes_word_loop_spec_6
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w6.val = 0) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 6#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, v, w7] ∧
v.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb48 : b48.val < 2^8 := by scalar_tac
have hbb49 : b49.val < 2^8 := by scalar_tac
have hbb50 : b50.val < 2^8 := by scalar_tac
have hbb51 : b51.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 0: byte 48
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
step as ⟨q0, hq0⟩
have hq0v : q0.val = 48 := by
simp [hq0, hp0]
all_goals scalar_tac
step as ⟨x0, hx0⟩
simp [hb, hq0v] at hx0
step with UScalar.cast.step_spec as ⟨c0, hc0⟩
have hc0v : c0.val = b48.val := by
rw [hc0, UScalar.cast_val_eq, hx0]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s0, hsh0⟩
have hsv0 : s0.val = 0 := by
simp [hsh0]
all_goals scalar_tac
step as ⟨t0, ht0⟩
have ht0v : t0.val = b48.val * 2^0 := by
rw [ht0]
simp [hsv0, hc0v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u0, hu0⟩
simp [hw] at hu0
have hu0v : u0.val = 0 := by rw [hu0]; exact hz
step as ⟨y0, hy0⟩
have hy0v : y0.val = b48.val := by
simp [hy0, UScalar.val_or, hu0v, ht0v]
step as ⟨wn0, hwn0⟩
try simp only [spec_ok]
-- j = 1: byte 49
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
step as ⟨q1, hq1⟩
have hq1v : q1.val = 49 := by
simp [hq1, hp1, hs0, he0]
all_goals scalar_tac
step as ⟨x1, hx1⟩
simp [hb, hq1v] at hx1
step with UScalar.cast.step_spec as ⟨c1, hc1⟩
have hc1v : c1.val = b49.val := by
rw [hc1, UScalar.cast_val_eq, hx1]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s1, hsh1⟩
have hsv1 : s1.val = 8 := by
simp [hsh1, hs0, he0]
all_goals scalar_tac
step as ⟨t1, ht1⟩
have ht1v : t1.val = b49.val * 2^8 := by
rw [ht1]
simp [hsv1, hc1v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u1, hu1⟩
simp [hwn0, hw] at hu1
have hu1v : u1.val = b48.val := by rw [hu1]; exact hy0v
step as ⟨y1, hy1⟩
have hy1v : y1.val = b48.val + b49.val * 2^8 := by
have hult : u1.val < 2^8 := by rw [hu1v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u1.val) (i := 8) hult b49.val
have hadd : u1.val ||| b49.val * 2^8 = u1.val + b49.val * 2^8 := by
calc u1.val ||| b49.val * 2^8
= u1.val ||| 2^8 * b49.val := by rw [Nat.mul_comm]
_ = 2^8 * b49.val ||| u1.val := Nat.lor_comm _ _
_ = 2^8 * b49.val + u1.val := hor.symm
_ = u1.val + b49.val * 2^8 := by ring
simp only [hy1, UScalar.val_or, ht1v]
rw [hadd, hu1v]
all_goals ring
step as ⟨wn1, hwn1⟩
try simp only [spec_ok]
-- j = 2: byte 50
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
step as ⟨q2, hq2⟩
have hq2v : q2.val = 50 := by
simp [hq2, hp2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨x2, hx2⟩
simp [hb, hq2v] at hx2
step with UScalar.cast.step_spec as ⟨c2, hc2⟩
have hc2v : c2.val = b50.val := by
rw [hc2, UScalar.cast_val_eq, hx2]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s2, hsh2⟩
have hsv2 : s2.val = 16 := by
simp [hsh2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨t2, ht2⟩
have ht2v : t2.val = b50.val * 2^16 := by
rw [ht2]
simp [hsv2, hc2v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u2, hu2⟩
simp [hwn1, hw] at hu2
have hu2v : u2.val = b48.val + b49.val * 2^8 := by rw [hu2]; exact hy1v
step as ⟨y2, hy2⟩
have hy2v : y2.val = b48.val + b49.val * 2^8 + b50.val * 2^16 := by
have hult : u2.val < 2^16 := by rw [hu2v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u2.val) (i := 16) hult b50.val
have hadd : u2.val ||| b50.val * 2^16 = u2.val + b50.val * 2^16 := by
calc u2.val ||| b50.val * 2^16
= u2.val ||| 2^16 * b50.val := by rw [Nat.mul_comm]
_ = 2^16 * b50.val ||| u2.val := Nat.lor_comm _ _
_ = 2^16 * b50.val + u2.val := hor.symm
_ = u2.val + b50.val * 2^16 := by ring
simp only [hy2, UScalar.val_or, ht2v]
rw [hadd, hu2v]
all_goals ring
step as ⟨wn2, hwn2⟩
try simp only [spec_ok]
-- j = 3: byte 51
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
step as ⟨q3, hq3⟩
have hq3v : q3.val = 51 := by
simp [hq3, hp3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨x3, hx3⟩
simp [hb, hq3v] at hx3
step with UScalar.cast.step_spec as ⟨c3, hc3⟩
have hc3v : c3.val = b51.val := by
rw [hc3, UScalar.cast_val_eq, hx3]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s3, hsh3⟩
have hsv3 : s3.val = 24 := by
simp [hsh3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨t3, ht3⟩
have ht3v : t3.val = b51.val * 2^24 := by
rw [ht3]
simp [hsv3, hc3v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u3, hu3⟩
simp [hwn2, hw] at hu3
have hu3v : u3.val = b48.val + b49.val * 2^8 + b50.val * 2^16 := by rw [hu3]; exact hy2v
step as ⟨y3, hy3⟩
have hy3v : y3.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 := by
have hult : u3.val < 2^24 := by rw [hu3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u3.val) (i := 24) hult b51.val
have hadd : u3.val ||| b51.val * 2^24 = u3.val + b51.val * 2^24 := by
calc u3.val ||| b51.val * 2^24
= u3.val ||| 2^24 * b51.val := by rw [Nat.mul_comm]
_ = 2^24 * b51.val ||| u3.val := Nat.lor_comm _ _
_ = 2^24 * b51.val + u3.val := hor.symm
_ = u3.val + b51.val * 2^24 := by ring
simp only [hy3, UScalar.val_or, ht3v]
rw [hadd, hu3v]
all_goals ring
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 6#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, v, w7] ∧
v.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, w3, w4, w5, y3, w7] := by
simp [hwn0, hwn1, hwn2, hwn3, hw, Array.set_val_eq]
have hst3 : iter3.start.val = 4 := by
simp [hs3, hs2, hs1, hs0]
all_goals scalar_tac
have hend3 : iter3.«end» = 8#usize := by
simp [he3, he2, he1, he0]
exact bytes_word_loop_tail_6 bytes wn3 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
w0 w1 w2 w3 w4 w5 y3 w7 iter3 hb hwn3l hst3 hend3 hy3v
/-- Inner byte loop for word 7, iterations 4..7 + exit: continues the
accumulation from the mid-state (bytes 56..59 absorbed). -/
theorem bytes_word_loop_tail_7
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(iter : core.ops.range.Range Std.Usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w7.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 7#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, w6, v] ∧
v.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb56 : b56.val < 2^8 := by scalar_tac
have hbb57 : b57.val < 2^8 := by scalar_tac
have hbb58 : b58.val < 2^8 := by scalar_tac
have hbb59 : b59.val < 2^8 := by scalar_tac
have hbb60 : b60.val < 2^8 := by scalar_tac
have hbb61 : b61.val < 2^8 := by scalar_tac
have hbb62 : b62.val < 2^8 := by scalar_tac
have hbb63 : b63.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 4: byte 60
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
step as ⟨q4, hq4⟩
have hq4v : q4.val = 60 := by
simp [hq4, hp4, hst]
all_goals scalar_tac
step as ⟨x4, hx4⟩
simp [hb, hq4v] at hx4
step with UScalar.cast.step_spec as ⟨c4, hc4⟩
have hc4v : c4.val = b60.val := by
rw [hc4, UScalar.cast_val_eq, hx4]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s4, hsh4⟩
have hsv4 : s4.val = 32 := by
simp [hsh4, hst]
all_goals scalar_tac
step as ⟨t4, ht4⟩
have ht4v : t4.val = b60.val * 2^32 := by
rw [ht4]
simp [hsv4, hc4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u4, hu4⟩
simp [hw] at hu4
have hu4v : u4.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 := by rw [hu4]; exact hacc
step as ⟨y4, hy4⟩
have hy4v : y4.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 := by
have hult : u4.val < 2^32 := by rw [hu4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u4.val) (i := 32) hult b60.val
have hadd : u4.val ||| b60.val * 2^32 = u4.val + b60.val * 2^32 := by
calc u4.val ||| b60.val * 2^32
= u4.val ||| 2^32 * b60.val := by rw [Nat.mul_comm]
_ = 2^32 * b60.val ||| u4.val := Nat.lor_comm _ _
_ = 2^32 * b60.val + u4.val := hor.symm
_ = u4.val + b60.val * 2^32 := by ring
simp only [hy4, UScalar.val_or, ht4v]
rw [hadd, hu4v]
all_goals ring
step as ⟨wn4, hwn4⟩
try simp only [spec_ok]
-- j = 5: byte 61
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
step as ⟨q5, hq5⟩
have hq5v : q5.val = 61 := by
simp [hq5, hp5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨x5, hx5⟩
simp [hb, hq5v] at hx5
step with UScalar.cast.step_spec as ⟨c5, hc5⟩
have hc5v : c5.val = b61.val := by
rw [hc5, UScalar.cast_val_eq, hx5]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s5, hsh5⟩
have hsv5 : s5.val = 40 := by
simp [hsh5, hst, hs4, he4]
all_goals scalar_tac
step as ⟨t5, ht5⟩
have ht5v : t5.val = b61.val * 2^40 := by
rw [ht5]
simp [hsv5, hc5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u5, hu5⟩
simp [hwn4, hw] at hu5
have hu5v : u5.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 := by rw [hu5]; exact hy4v
step as ⟨y5, hy5⟩
have hy5v : y5.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 := by
have hult : u5.val < 2^40 := by rw [hu5v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u5.val) (i := 40) hult b61.val
have hadd : u5.val ||| b61.val * 2^40 = u5.val + b61.val * 2^40 := by
calc u5.val ||| b61.val * 2^40
= u5.val ||| 2^40 * b61.val := by rw [Nat.mul_comm]
_ = 2^40 * b61.val ||| u5.val := Nat.lor_comm _ _
_ = 2^40 * b61.val + u5.val := hor.symm
_ = u5.val + b61.val * 2^40 := by ring
simp only [hy5, UScalar.val_or, ht5v]
rw [hadd, hu5v]
all_goals ring
step as ⟨wn5, hwn5⟩
try simp only [spec_ok]
-- j = 6: byte 62
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
step as ⟨q6, hq6⟩
have hq6v : q6.val = 62 := by
simp [hq6, hp6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨x6, hx6⟩
simp [hb, hq6v] at hx6
step with UScalar.cast.step_spec as ⟨c6, hc6⟩
have hc6v : c6.val = b62.val := by
rw [hc6, UScalar.cast_val_eq, hx6]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s6, hsh6⟩
have hsv6 : s6.val = 48 := by
simp [hsh6, hst, hs4, he4, hs5, he5]
all_goals scalar_tac
step as ⟨t6, ht6⟩
have ht6v : t6.val = b62.val * 2^48 := by
rw [ht6]
simp [hsv6, hc6v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u6, hu6⟩
simp [hwn5, hw] at hu6
have hu6v : u6.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 := by rw [hu6]; exact hy5v
step as ⟨y6, hy6⟩
have hy6v : y6.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 := by
have hult : u6.val < 2^48 := by rw [hu6v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u6.val) (i := 48) hult b62.val
have hadd : u6.val ||| b62.val * 2^48 = u6.val + b62.val * 2^48 := by
calc u6.val ||| b62.val * 2^48
= u6.val ||| 2^48 * b62.val := by rw [Nat.mul_comm]
_ = 2^48 * b62.val ||| u6.val := Nat.lor_comm _ _
_ = 2^48 * b62.val + u6.val := hor.symm
_ = u6.val + b62.val * 2^48 := by ring
simp only [hy6, UScalar.val_or, ht6v]
rw [hadd, hu6v]
all_goals ring
step as ⟨wn6, hwn6⟩
try simp only [spec_ok]
-- j = 7: byte 63
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
step as ⟨q7, hq7⟩
have hq7v : q7.val = 63 := by
simp [hq7, hp7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨x7, hx7⟩
simp [hb, hq7v] at hx7
step with UScalar.cast.step_spec as ⟨c7, hc7⟩
have hc7v : c7.val = b63.val := by
rw [hc7, UScalar.cast_val_eq, hx7]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s7, hsh7⟩
have hsv7 : s7.val = 56 := by
simp [hsh7, hst, hs4, he4, hs5, he5, hs6, he6]
all_goals scalar_tac
step as ⟨t7, ht7⟩
have ht7v : t7.val = b63.val * 2^56 := by
rw [ht7]
simp [hsv7, hc7v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u7, hu7⟩
simp [hwn6, hw] at hu7
have hu7v : u7.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 := by rw [hu7]; exact hy6v
step as ⟨y7, hy7⟩
have hy7v : y7.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 := by
have hult : u7.val < 2^56 := by rw [hu7v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u7.val) (i := 56) hult b63.val
have hadd : u7.val ||| b63.val * 2^56 = u7.val + b63.val * 2^56 := by
calc u7.val ||| b63.val * 2^56
= u7.val ||| 2^56 * b63.val := by rw [Nat.mul_comm]
_ = 2^56 * b63.val ||| u7.val := Nat.lor_comm _ _
_ = 2^56 * b63.val + u7.val := hor.symm
_ = u7.val + b63.val * 2^56 := by ring
simp only [hy7, UScalar.val_or, ht7v]
rw [hadd, hu7v]
all_goals ring
step as ⟨wn7, hwn7⟩
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
refine ⟨y7, ?_, hy7v⟩
simp [hwn4, hwn5, hwn6, hwn7, hw, Array.set_val_eq]
/-- Inner byte loop, outer index 7: word 7 accumulates bytes
56..63 little-endian; the other words are untouched.
Iterations 0..3 here; 4..7 + exit in `bytes_word_loop_tail_7`
(the 8-fold monolith exceeds the elaboration budget — METHOD 4). -/
theorem bytes_word_loop_spec_7
(bytes : Std.Array Std.U8 64#usize)
(words : Std.Array Std.U64 8#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(w0 w1 w2 w3 w4 w5 w6 w7 : U64)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w7.val = 0) :
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 7#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, w6, v] ∧
v.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
have hbb56 : b56.val < 2^8 := by scalar_tac
have hbb57 : b57.val < 2^8 := by scalar_tac
have hbb58 : b58.val < 2^8 := by scalar_tac
have hbb59 : b59.val < 2^8 := by scalar_tac
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
-- j = 0: byte 56
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
step as ⟨q0, hq0⟩
have hq0v : q0.val = 56 := by
simp [hq0, hp0]
all_goals scalar_tac
step as ⟨x0, hx0⟩
simp [hb, hq0v] at hx0
step with UScalar.cast.step_spec as ⟨c0, hc0⟩
have hc0v : c0.val = b56.val := by
rw [hc0, UScalar.cast_val_eq, hx0]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s0, hsh0⟩
have hsv0 : s0.val = 0 := by
simp [hsh0]
all_goals scalar_tac
step as ⟨t0, ht0⟩
have ht0v : t0.val = b56.val * 2^0 := by
rw [ht0]
simp [hsv0, hc0v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u0, hu0⟩
simp [hw] at hu0
have hu0v : u0.val = 0 := by rw [hu0]; exact hz
step as ⟨y0, hy0⟩
have hy0v : y0.val = b56.val := by
simp [hy0, UScalar.val_or, hu0v, ht0v]
step as ⟨wn0, hwn0⟩
try simp only [spec_ok]
-- j = 1: byte 57
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
step as ⟨q1, hq1⟩
have hq1v : q1.val = 57 := by
simp [hq1, hp1, hs0, he0]
all_goals scalar_tac
step as ⟨x1, hx1⟩
simp [hb, hq1v] at hx1
step with UScalar.cast.step_spec as ⟨c1, hc1⟩
have hc1v : c1.val = b57.val := by
rw [hc1, UScalar.cast_val_eq, hx1]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s1, hsh1⟩
have hsv1 : s1.val = 8 := by
simp [hsh1, hs0, he0]
all_goals scalar_tac
step as ⟨t1, ht1⟩
have ht1v : t1.val = b57.val * 2^8 := by
rw [ht1]
simp [hsv1, hc1v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u1, hu1⟩
simp [hwn0, hw] at hu1
have hu1v : u1.val = b56.val := by rw [hu1]; exact hy0v
step as ⟨y1, hy1⟩
have hy1v : y1.val = b56.val + b57.val * 2^8 := by
have hult : u1.val < 2^8 := by rw [hu1v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u1.val) (i := 8) hult b57.val
have hadd : u1.val ||| b57.val * 2^8 = u1.val + b57.val * 2^8 := by
calc u1.val ||| b57.val * 2^8
= u1.val ||| 2^8 * b57.val := by rw [Nat.mul_comm]
_ = 2^8 * b57.val ||| u1.val := Nat.lor_comm _ _
_ = 2^8 * b57.val + u1.val := hor.symm
_ = u1.val + b57.val * 2^8 := by ring
simp only [hy1, UScalar.val_or, ht1v]
rw [hadd, hu1v]
all_goals ring
step as ⟨wn1, hwn1⟩
try simp only [spec_ok]
-- j = 2: byte 58
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
step as ⟨q2, hq2⟩
have hq2v : q2.val = 58 := by
simp [hq2, hp2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨x2, hx2⟩
simp [hb, hq2v] at hx2
step with UScalar.cast.step_spec as ⟨c2, hc2⟩
have hc2v : c2.val = b58.val := by
rw [hc2, UScalar.cast_val_eq, hx2]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s2, hsh2⟩
have hsv2 : s2.val = 16 := by
simp [hsh2, hs0, he0, hs1, he1]
all_goals scalar_tac
step as ⟨t2, ht2⟩
have ht2v : t2.val = b58.val * 2^16 := by
rw [ht2]
simp [hsv2, hc2v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u2, hu2⟩
simp [hwn1, hw] at hu2
have hu2v : u2.val = b56.val + b57.val * 2^8 := by rw [hu2]; exact hy1v
step as ⟨y2, hy2⟩
have hy2v : y2.val = b56.val + b57.val * 2^8 + b58.val * 2^16 := by
have hult : u2.val < 2^16 := by rw [hu2v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u2.val) (i := 16) hult b58.val
have hadd : u2.val ||| b58.val * 2^16 = u2.val + b58.val * 2^16 := by
calc u2.val ||| b58.val * 2^16
= u2.val ||| 2^16 * b58.val := by rw [Nat.mul_comm]
_ = 2^16 * b58.val ||| u2.val := Nat.lor_comm _ _
_ = 2^16 * b58.val + u2.val := hor.symm
_ = u2.val + b58.val * 2^16 := by ring
simp only [hy2, UScalar.val_or, ht2v]
rw [hadd, hu2v]
all_goals ring
step as ⟨wn2, hwn2⟩
try simp only [spec_ok]
-- j = 3: byte 59
apply loop_step
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
step as ⟨q3, hq3⟩
have hq3v : q3.val = 59 := by
simp [hq3, hp3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨x3, hx3⟩
simp [hb, hq3v] at hx3
step with UScalar.cast.step_spec as ⟨c3, hc3⟩
have hc3v : c3.val = b59.val := by
rw [hc3, UScalar.cast_val_eq, hx3]
simp only [UScalarTy.U64, UScalarTy.numBits]
omega
step as ⟨s3, hsh3⟩
have hsv3 : s3.val = 24 := by
simp [hsh3, hs0, he0, hs1, he1, hs2, he2]
all_goals scalar_tac
step as ⟨t3, ht3⟩
have ht3v : t3.val = b59.val * 2^24 := by
rw [ht3]
simp [hsv3, hc3v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨u3, hu3⟩
simp [hwn2, hw] at hu3
have hu3v : u3.val = b56.val + b57.val * 2^8 + b58.val * 2^16 := by rw [hu3]; exact hy2v
step as ⟨y3, hy3⟩
have hy3v : y3.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 := by
have hult : u3.val < 2^24 := by rw [hu3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := u3.val) (i := 24) hult b59.val
have hadd : u3.val ||| b59.val * 2^24 = u3.val + b59.val * 2^24 := by
calc u3.val ||| b59.val * 2^24
= u3.val ||| 2^24 * b59.val := by rw [Nat.mul_comm]
_ = 2^24 * b59.val ||| u3.val := Nat.lor_comm _ _
_ = 2^24 * b59.val + u3.val := hor.symm
_ = u3.val + b59.val * 2^24 := by ring
simp only [hy3, UScalar.val_or, ht3v]
rw [hadd, hu3v]
all_goals ring
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512 digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8 loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul by R and RR (R cancels as a unit, RR restores it) -> the canonical add. The two kernel-capacity walls found and crossed en route (control repo FAILURES.md updated): - a montgomery_mul inside any walk motive replays its 400-line body at every kernel step (fix: named prefix functions in the pinned source); - straight-line IndexMut closure chains make kernel defeq exponential in depth (fix: struct-literal construction - the split halves now build Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive. Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts -> split_words_lo/hi; documented pure refactors, cargo-checked). check-scalar.sh: 13 proof files, 13 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-04 09:00:49 +00:00
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 7#usize
Signature layer: the 64-byte unpack certificates (8x8 loops proven) Toward Scalar::from_hash: bytes_unpack_spec proves the from_bytes_wide word-unpack loops pack 64 little-endian bytes into 8 words exactly. - Proofs/ScalarBytesSpec.lean (3308 lines): bytes_word_loop_spec_0..7, each split head/tail at j=4 (the 8-fold monolith grows exponentially in elaboration - METHOD 4). Disjoint-bit ORs become additions via core's Nat.two_pow_add_eq_or_of_lt with explicit calc bridges (the default simp set literalizes 2^8 -> 256 and breaks pow-form rewrites; simp only everywhere). - Proofs/ScalarUnpackSpec.lean: bytes_unpack_spec composes the eight inner lemmas through the outer loop (iterator start needs a term-level equality rewrite per peel). The from_bytes_wide main walk itself is proven at elaboration level (fail-probe verified end to end) but its single-decl kernel certificate replays >30min; it ships next as a phase-split (plan in the control repo's method notes). check-scalar.sh: 12 proof files, 12 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button green.
2026-07-04 01:22:27 +00:00
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, w6, v] ∧
v.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, w3, w4, w5, w6, y3] := by
simp [hwn0, hwn1, hwn2, hwn3, hw, Array.set_val_eq]
have hst3 : iter3.start.val = 4 := by
simp [hs3, hs2, hs1, hs0]
all_goals scalar_tac
have hend3 : iter3.«end» = 8#usize := by
simp [he3, he2, he1, he0]
exact bytes_word_loop_tail_7 bytes wn3 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
w0 w1 w2 w3 w4 w5 w6 y3 iter3 hb hwn3l hst3 hend3 hy3v
end ScalarProofs
Reference in a new issue Copy permalink