2026-07-02 12:42:46 +00:00
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
# Regenerate the Lean model in gen/ from the Rust sources.
|
|
|
|
|
#
|
2026-07-02 13:04:25 +00:00
|
|
|
# SCOPE: field arithmetic + Edwards point arithmetic
|
|
|
|
|
# roots: crate::field, crate::backend::serial::u64::field,
|
|
|
|
|
# crate::backend::serial::curve_models, crate::edwards
|
|
|
|
|
# (same widening the reference solution used for its Tier-1 addition-law
|
PHASE 2 COMPLETE ON ANZA: THE FULL POINT-LEVEL LIFT
(verify_accepts_iff_decompress, button-enforced)
Port of the dalek decompress chain (byte-identical gen: the anza
extraction of sqrt_ratio_i / from_bytes / decompress matches dalek's
exactly, so DecompressSpec + FromBytesSpec port verbatim modulo the
crate namespace):
- source patch 994c469 (solana-ed25519): decompress step_2
negate-then-conditional-assign (the documented sqrt_ratio_i rewrite);
extract.sh: decompress un-opaqued, re-extracted (the step_1/step_2
external axioms vanish from the template - decompress is transparent).
- Proofs/DecompressSpec.lean: pow_p58, ct_eq/cond-assign semantics,
sqrt_core, sqrt_ratio_i_sq_spec (even root, v*r^2 = u).
- Proofs/FromBytesSpec.lean: load8_at loader, 5-window LE parse,
from_bytes_spec (exact below bit 255).
- Proofs/DecompressMain.lean: edwards_d_denote, decompress_of_canonical
(standard three axioms), verify_accepts_iff_decompress against the
anza apex shape (rb/sb/s, minus_A):
accept <=> decompress(R) = [k]*minus_A + [s]*B (as points).
check.sh: 4-tier Phase 3b (byte apex, half-lift, point equation, full
lift), each cone exactly [3 standard + Signature + sha512_hash3 +
r_bytes + s_bytes]. Full button green fresh.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-05 23:07:14 +00:00
|
|
|
# theorem; scalar-mul backends stay opaque — upstream Aeneas cannot
|
|
|
|
|
# translate them; they are modeled/axiomatized in
|
|
|
|
|
# gen/CurveField/FunsExternal.lean OUTSIDE every certificate's cone.
|
|
|
|
|
# decompress IS extracted since the phase-2 full lift — the source's
|
|
|
|
|
# step_2 uses the documented negate-then-conditional-assign rewrite).
|
2026-07-02 13:04:25 +00:00
|
|
|
#
|
|
|
|
|
# Rust --charon--> CurveField.llbc --aeneas--> gen/CurveField/*.lean
|
2026-07-02 12:42:46 +00:00
|
|
|
#
|
|
|
|
|
# The hand-written gen/CurveField/{TypesExternal,FunsExternal}.lean are NOT
|
|
|
|
|
# touched by regeneration (Aeneas only rewrites the *_Template variants).
|
2026-07-02 13:04:25 +00:00
|
|
|
# After regenerating, diff the templates against the hand-written files:
|
2026-07-02 12:42:46 +00:00
|
|
|
# diff gen/CurveField/FunsExternal_Template.lean gen/CurveField/FunsExternal.lean
|
|
|
|
|
#
|
P2-c: classify and pin the extraction boundary
Aeneas emits a *_Template.lean naming everything the extracted code needs
from outside itself — the extraction's own statement of its boundary.
extract.sh has always said, in prose, "after regenerating, diff the template
against the hand-written file". Prose is not a gate, and the diff cannot be
one: the two files legitimately differ in almost every line, holes and
Aeneas comments against real definitions and modeling policy.
MEASURING FIRST CHANGED WHAT THIS ITEM SHOULD BE. The TODO offered two
options — enforce the diff, or pin both files — and the answer turned out to
be neither. Both files were ALREADY byte-pinned by Phase 0b. And two further
things stand here: the generated Funs.lean imports the model and CALLS these
externals, so the Lean compiler enforces their TYPES wherever the extracted
code uses them; and the per-certificate exact cones catch any external that
becomes, or stops being, an assumption anything depends on.
What none of those three sees is the CLASSIFICATION: for each name the
extraction asks for, whether this repository answers with an ASSUMPTION or
with a PROOF. That is the tier-A/B claim the documents make in prose — the
curve calls and the three curve types resolve to proven definitions rather
than axioms, because gen/CurveField/Funs.lean opens `namespace
curve25519_dalek` and so defines the very names Aeneas asks for. Nothing
checked it. A regeneration that renamed one, or a model that quietly
answered one with an axiom instead, would have left the documents claiming a
proof where the repository had an assumption.
Phase 0d recomputes the classification with model-correspondence.py
(namespace-aware, so a definition inside a namespace counts under its full
name) and requires equality with the committed MODEL-CORRESPONDENCE.txt.
UNRESOLVED — the extraction asking for something nothing here provides — is
a hard failure.
dalek 43 MODEL 8 PROVEN 3 EXTRA
anza 38 MODEL 0 PROVEN 4 EXTRA (no CurveSig crate)
risc0 36 MODEL 8 PROVEN 4 EXTRA
betrusted 35 MODEL 8 PROVEN 4 EXTRA
selftest-correspondence.sh, five cases, negative-tested by disabling the
comparison. The case that matters is 2: a PROVEN external answered by an
axiom instead. No name changes anywhere, every byte pin still matches, and
it compiles, because the signature is unchanged — before Phase 0d nothing in
the button could tell.
Trap recorded for whoever extends it: case 3 first deleted the PROVEN rows,
which was VACUOUS on anza, since anza has none — it removed nothing, the
table still matched, and the case passed while testing nothing. It now
deletes the first row whatever its verdict AND asserts the file changed.
extract.sh now points at the gate instead of asking a human to look.
Certified by a full sweep: both buttons, all four forks, purged trees,
machine otherwise idle. 8/8 green.
2026-07-31 15:53:31 +00:00
|
|
|
# That diff is a READING aid, not a gate — the two files legitimately differ in
|
|
|
|
|
# almost every line (the template holds holes and Aeneas's own comments; the
|
|
|
|
|
# model holds real definitions and the modeling policy). What IS enforced, by
|
|
|
|
|
# check.sh Phase 0d, is the classification: every name the template declares
|
|
|
|
|
# must be answered either by the hand-written model or by a real definition in
|
|
|
|
|
# the proven corpus, and which of the two must match MODEL-CORRESPONDENCE.txt.
|
|
|
|
|
# Regenerate that table with `python3 model-correspondence.py .` and commit the
|
|
|
|
|
# change deliberately — a proof silently becoming an assumption is exactly what
|
|
|
|
|
# the phase exists to stop.
|
|
|
|
|
#
|
2026-07-02 12:42:46 +00:00
|
|
|
# Usage: ./extract.sh
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
|
|
|
|
|
source ~/aeneas-toolchain/env.sh
|
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
2026-07-02 13:04:25 +00:00
|
|
|
CRATE=~/GitClone/FormalVerification/sources/anza-cryptography-source/curve25519/solana-ed25519
|
2026-07-02 12:42:46 +00:00
|
|
|
|
THE SIGNATURE APEX on the anza fork: verify_accepts_iff, button-enforced
FOURTH AND FINAL PYRAMID CAPPED - the signature layer is complete on all
four ed25519 forks. anza's verify code lives in the same crate as the
curve (solana-ed25519), so the whole verify path joins the merged
CurveField extraction directly: one universe, no glue layer, no FQ-name
welding, and the Error enum plus the parse/filter helpers are all real
extracted code.
- extract.sh: verify_sha512 start-from joins the merged stanza;
sha512_hash3 and the foreign ed25519 crate opaque; RUSTFLAGS
--cfg curve25519_serial_only pins the serial backend so
get_selected_backend extracts as the real constant Serial (the stale
dispatch axiom is deleted from FunsExternal).
- gen/CurveField externals: real defs for the ?-operator plumbing
(Try::branch, FromResidual) and faithful identity models for
Choice::unwrap_u8 (transparent-u8 body: self.0) and the RangeFull
get_unchecked[_mut] raw-pointer pair (Rust body returns the pointer
unchanged) - the three would-be cone intruders, eliminated.
- Proofs/SigApexSpec.lean: verify_loop_full (standard three-axiom cone)
and verify_accepts_iff - the verifier accepts IFF the recomputed
compress([k](-A) + [s]B) equals the signature's R byte-for-byte, with
the ZIP-215 legacy filters and the s < l parse conditioned by
hypotheses, mirroring the siblings' hparse.
- check.sh Phase 3b enforces the apex cone to be EXACTLY
[propext, Classical.choice, Quot.sound, ed25519.Signature,
ed_sigs.sha512_hash3, ed25519.Signature.r_bytes,
ed25519.Signature.s_bytes]
- the tightest boundary of the four pyramids: the SHA-512 oracle plus
the foreign wire-format type and its two byte accessors, nothing else.
check.sh (incl. Phase 3b) + check-scalar.sh both green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-04 21:48:08 +00:00
|
|
|
echo "[1/2] charon: Rust -> LLBC (field + curve_models + edwards + scalar + verify [MERGED GEN])"
|
2026-07-02 12:42:46 +00:00
|
|
|
cd "$CRATE"
|
THE SIGNATURE APEX on the anza fork: verify_accepts_iff, button-enforced
FOURTH AND FINAL PYRAMID CAPPED - the signature layer is complete on all
four ed25519 forks. anza's verify code lives in the same crate as the
curve (solana-ed25519), so the whole verify path joins the merged
CurveField extraction directly: one universe, no glue layer, no FQ-name
welding, and the Error enum plus the parse/filter helpers are all real
extracted code.
- extract.sh: verify_sha512 start-from joins the merged stanza;
sha512_hash3 and the foreign ed25519 crate opaque; RUSTFLAGS
--cfg curve25519_serial_only pins the serial backend so
get_selected_backend extracts as the real constant Serial (the stale
dispatch axiom is deleted from FunsExternal).
- gen/CurveField externals: real defs for the ?-operator plumbing
(Try::branch, FromResidual) and faithful identity models for
Choice::unwrap_u8 (transparent-u8 body: self.0) and the RangeFull
get_unchecked[_mut] raw-pointer pair (Rust body returns the pointer
unchanged) - the three would-be cone intruders, eliminated.
- Proofs/SigApexSpec.lean: verify_loop_full (standard three-axiom cone)
and verify_accepts_iff - the verifier accepts IFF the recomputed
compress([k](-A) + [s]B) equals the signature's R byte-for-byte, with
the ZIP-215 legacy filters and the s < l parse conditioned by
hypotheses, mirroring the siblings' hparse.
- check.sh Phase 3b enforces the apex cone to be EXACTLY
[propext, Classical.choice, Quot.sound, ed25519.Signature,
ed_sigs.sha512_hash3, ed25519.Signature.r_bytes,
ed25519.Signature.s_bytes]
- the tightest boundary of the four pyramids: the SHA-512 oracle plus
the foreign wire-format type and its two byte accessors, nothing else.
check.sh (incl. Phase 3b) + check-scalar.sh both green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-04 21:48:08 +00:00
|
|
|
# Pin the serial backend: the AVX2 dispatch arm compiles out, so backend
|
|
|
|
|
# selection extracts as the real constant Serial (no dispatch axiom).
|
|
|
|
|
export RUSTFLAGS='--cfg curve25519_serial_only'
|
|
|
|
|
cargo clean -p solana-ed25519 2>/dev/null || true
|
2026-07-02 12:42:46 +00:00
|
|
|
charon cargo --preset=aeneas \
|
|
|
|
|
--start-from crate::field \
|
|
|
|
|
--start-from crate::backend::serial::u64::field \
|
2026-07-02 13:04:25 +00:00
|
|
|
--start-from crate::backend::serial::curve_models \
|
|
|
|
|
--start-from crate::edwards \
|
2026-07-04 21:15:54 +00:00
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::add' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::sub' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::mul' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::square' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_mul' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_square' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_reduce' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_invert' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::as_montgomery' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::from_montgomery' \
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::from_bytes_wide' \
|
|
|
|
|
--start-from 'crate::scalar::_::from_bytes_mod_order' \
|
|
|
|
|
--start-from 'crate::scalar::_::from_bytes_mod_order_wide' \
|
THE SIGNATURE APEX on the anza fork: verify_accepts_iff, button-enforced
FOURTH AND FINAL PYRAMID CAPPED - the signature layer is complete on all
four ed25519 forks. anza's verify code lives in the same crate as the
curve (solana-ed25519), so the whole verify path joins the merged
CurveField extraction directly: one universe, no glue layer, no FQ-name
welding, and the Error enum plus the parse/filter helpers are all real
extracted code.
- extract.sh: verify_sha512 start-from joins the merged stanza;
sha512_hash3 and the foreign ed25519 crate opaque; RUSTFLAGS
--cfg curve25519_serial_only pins the serial backend so
get_selected_backend extracts as the real constant Serial (the stale
dispatch axiom is deleted from FunsExternal).
- gen/CurveField externals: real defs for the ?-operator plumbing
(Try::branch, FromResidual) and faithful identity models for
Choice::unwrap_u8 (transparent-u8 body: self.0) and the RangeFull
get_unchecked[_mut] raw-pointer pair (Rust body returns the pointer
unchanged) - the three would-be cone intruders, eliminated.
- Proofs/SigApexSpec.lean: verify_loop_full (standard three-axiom cone)
and verify_accepts_iff - the verifier accepts IFF the recomputed
compress([k](-A) + [s]B) equals the signature's R byte-for-byte, with
the ZIP-215 legacy filters and the s < l parse conditioned by
hypotheses, mirroring the siblings' hparse.
- check.sh Phase 3b enforces the apex cone to be EXACTLY
[propext, Classical.choice, Quot.sound, ed25519.Signature,
ed_sigs.sha512_hash3, ed25519.Signature.r_bytes,
ed25519.Signature.s_bytes]
- the tightest boundary of the four pyramids: the SHA-512 oracle plus
the foreign wire-format type and its two byte accessors, nothing else.
check.sh (incl. Phase 3b) + check-scalar.sh both green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-04 21:48:08 +00:00
|
|
|
--start-from 'crate::ed_sigs::verification_key::_::verify_sha512' \
|
|
|
|
|
--opaque 'crate::ed_sigs::sha512_hash3' \
|
|
|
|
|
--opaque 'ed25519' \
|
2026-07-02 12:42:46 +00:00
|
|
|
--opaque 'crate::field::_::internal_invert_batch' \
|
2026-07-04 10:20:35 +00:00
|
|
|
--opaque 'crate::backend::serial::scalar_mul::variable_base' \
|
|
|
|
|
--opaque 'crate::backend::serial::scalar_mul::vartime_triple_base' \
|
|
|
|
|
--opaque 'crate::scalar::_::non_adjacent_form_128' \
|
|
|
|
|
--opaque 'crate::backend::serial::scalar_mul::straus' \
|
|
|
|
|
--opaque 'crate::backend::serial::scalar_mul::precomputed_straus' \
|
|
|
|
|
--opaque 'crate::backend::serial::scalar_mul::pippenger' \
|
2026-07-02 13:04:25 +00:00
|
|
|
--opaque 'crate::backend::vector' \
|
|
|
|
|
--opaque 'crate::backend::scalar_fits_in_128_bits' \
|
|
|
|
|
--opaque 'crate::edwards::_::sum' \
|
|
|
|
|
--opaque 'crate::edwards::_::from_slice' \
|
2026-07-02 12:42:46 +00:00
|
|
|
--dest-file "$HERE/CurveField.llbc" \
|
|
|
|
|
-- --no-default-features
|
|
|
|
|
|
|
|
|
|
echo "[2/2] aeneas: LLBC -> Lean (split files, CurveField.* modules)"
|
|
|
|
|
cd "$HERE"
|
|
|
|
|
aeneas -backend lean -split-files -subdir CurveField -dest gen CurveField.llbc
|
|
|
|
|
|
|
|
|
|
echo "Done. Now run ./check.sh to type-check the regenerated model."
|