3 commits

Author	SHA1	Message	Date
mrwulf	ffe15db155	correspondence: a named section is not a namespace; an extra axiom is a failure ... Round-8 review (GPT-5.6, register key `section-prefix-bug`, CRITICAL). Reproduced here exactly before fixing. model-correspondence.py treated `namespace`, `section` and `end` as one event class and pushed a named section onto the fully-qualified-name prefix. Lean does not: `section Foo` opens a scope for `variable`/`open` and gives `end Foo` a label; it does not turn `bar` into `Foo.bar`. Given a template reading section Foo axiom bar : Nat end Foo the scanner reported `Foo.bar`, `--names` handed Phase 2d only `Foo.bar`, Lean resolved an unrelated `Foo.bar` definition elsewhere in the corpus, and the verdict came back PROVEN. The axiom the extraction ACTUALLY depends on was never queried. This survived both the fail-closed rewrite and the new Lean-semantic phase, in a scanner rewritten that same week specifically to stop dropping things. AND THE REASON IT STAYED SILENT, which is the half worth keeping. The real external did not vanish — it landed in the table as EXTRA, the one verdict that could not fail. A silent bucket beside a fail-closed parser is a slower way of dropping things. An extra AXIOM is now EXTRA-AXIOM and stops the button: the model exists to answer the template, so an assumption nothing asks for is either a parse we got wrong or an assumption nobody governs. Extra definitions stay tolerated; helpers in a model file are ordinary. That gate fired on the real corpora on its first run. Each fork's hand-maintained gen/CurveField/FunsExternal.lean carried AVX2/AVX512 backend axioms present in no template, no proof, no cone and no allowlist — dead assumptions in a pinned trusted-base file, reported as EXTRA and therefore invisible. extract.sh:16 confirms these files are never overwritten by extraction, so they were hand-written and are removed here: dalek 2, anza 3, risc0 4, betrusted 4 Nothing referenced them, so no certificate's cone changes; the trusted base simply gets smaller. Table rows 64->62, 51->48, 57->53, 56->52, and Phase 2d independently resolved 62/48/53/52 externals against the regenerated tables. GEN-MODEL.sha256 and HARNESS.sha256 both move: the model bytes changed, and the harness pins the table and the gen manifest themselves. Certified: round-10 sweep, 2h53m, ten instruments in each of four forks, 40/40 GREEN, 0 failing, 0 resource-limited. A full run was required — the --audit-only staleness gate correctly refused after a source change. Registered in formal-verification-control/review-findings.tsv as `section-prefix-bug` and `dead-model-axioms`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-08-02 21:29:54 +02:00
mrwulf	7cfa0872d4	Round-7 F1: make model/template correspondence SEMANTIC, and fail closed ... THE DEFECT, as found. GPT-5.6 showed the textual classifier could report PROVEN for a name Lean resolves to an axiom: a definition appearing only inside a `/- -/` comment was read as real. Repairing that exposed something larger and already live. Aeneas wraps long declarations: axiom curve25519_dalek.edwards.EdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint.neg The old scanner required keyword and name on one physical line, so it matched nothing there and SILENTLY DROPPED the declaration — no MODEL row, no PROVEN row, no failure. Nine to ten externals per fork had no row at all, and the tier-A/B `neg` was missing from every committed table while the trust documents claimed that class was machine-checked. Four pinned tables were wrong, in four repositories, with the buttons green over them. No attacker was required; Aeneas's own formatting did it. The lesson is not "write a better regex". The scanner was FAIL-OPEN: input it could not parse produced silence instead of a stop. A gate that drops what it cannot read is worse than no gate, because the green covers a gap that is invisible in the diff. THE REPAIR, in three layers that each do only what they honestly can. · DISCOVERY stays textual, because the template cannot be imported — it declares the same names as the model and they would clash. It now strips NESTED `/- -/` blocks, reads a name that wraps to a later line, tracks namespace/section/end, and FAILS CLOSED: an unparseable keyword exits 2 naming file and line. · Phase 0d keeps the cheap pre-compile comparison against the table. · Phase 2d is new and authoritative. After compilation it generates a temp Lean driver (the Phase 2b idiom, so no permanent module and no manifest churn), imports every non-template gen module, and asks env.find? what each external IS: kind and originating module. Model module -> MODEL; non-axiom in a generated module -> PROVEN; an axiom outside the model, or a name that does not resolve, is a failure. Lean's verdict must equal the committed table's, and the answer count must equal the question count so a truncated resolver cannot pass. THE TABLES were regenerated and verified three ways before being committed: an independently written second scanner agreed on 228/228 rows across the four forks; all 47 changed rows carry file:line evidence; and the PROVEN row was put to Lean directly — kind = def, module = CurveField.Funs. dalek 54 -> 64 rows anza 42 -> 51 risc0 48 -> 57 betrusted 47 -> 56 Also corrected: `from_residual` was recorded EXTRA in every fork; the template does demand it, so it is MODEL. anza carried a spurious `hash|EXTRA` row from a mis-parse. NEGATIVE-TESTED. With Phase 0d neutered so Phase 2d was the gate under test, a PROVEN row edited to MODEL produces: SEMANTIC DRIFT: ...neg — table says MODEL, Lean says PROVEN selftest-correspondence.sh grew 4 cases -> 7: GPT's comment counterexample, the wrapped declaration that was actually live, and a fail-closed check. WHAT THIS DOES NOT CLOSE. Phase 2d resolves names in the environment built from gen/. It establishes what a name IS — assumption or proof, and where — not that the extraction faithfully represents the Rust. That remains the Charon/Aeneas trust assumption and no gate here can close it. Certified: both buttons, all four forks, purged trees. 8/8 green, with 62/48/53/52 externals resolved by Lean and every verdict matching.	2026-08-02 02:24:15 +02:00
mrwulf	ee57493f26	P2-c: classify and pin the extraction boundary ... Aeneas emits a *_Template.lean naming everything the extracted code needs from outside itself — the extraction's own statement of its boundary. extract.sh has always said, in prose, "after regenerating, diff the template against the hand-written file". Prose is not a gate, and the diff cannot be one: the two files legitimately differ in almost every line, holes and Aeneas comments against real definitions and modeling policy. MEASURING FIRST CHANGED WHAT THIS ITEM SHOULD BE. The TODO offered two options — enforce the diff, or pin both files — and the answer turned out to be neither. Both files were ALREADY byte-pinned by Phase 0b. And two further things stand here: the generated Funs.lean imports the model and CALLS these externals, so the Lean compiler enforces their TYPES wherever the extracted code uses them; and the per-certificate exact cones catch any external that becomes, or stops being, an assumption anything depends on. What none of those three sees is the CLASSIFICATION: for each name the extraction asks for, whether this repository answers with an ASSUMPTION or with a PROOF. That is the tier-A/B claim the documents make in prose — the curve calls and the three curve types resolve to proven definitions rather than axioms, because gen/CurveField/Funs.lean opens `namespace curve25519_dalek` and so defines the very names Aeneas asks for. Nothing checked it. A regeneration that renamed one, or a model that quietly answered one with an axiom instead, would have left the documents claiming a proof where the repository had an assumption. Phase 0d recomputes the classification with model-correspondence.py (namespace-aware, so a definition inside a namespace counts under its full name) and requires equality with the committed MODEL-CORRESPONDENCE.txt. UNRESOLVED — the extraction asking for something nothing here provides — is a hard failure. dalek 43 MODEL 8 PROVEN 3 EXTRA anza 38 MODEL 0 PROVEN 4 EXTRA (no CurveSig crate) risc0 36 MODEL 8 PROVEN 4 EXTRA betrusted 35 MODEL 8 PROVEN 4 EXTRA selftest-correspondence.sh, five cases, negative-tested by disabling the comparison. The case that matters is 2: a PROVEN external answered by an axiom instead. No name changes anywhere, every byte pin still matches, and it compiles, because the signature is unchanged — before Phase 0d nothing in the button could tell. Trap recorded for whoever extends it: case 3 first deleted the PROVEN rows, which was VACUOUS on anza, since anza has none — it removed nothing, the table still matched, and the case passed while testing nothing. It now deletes the first row whatever its verdict AND asserts the file changed. extract.sh now points at the gate instead of asking a human to look. Certified by a full sweep: both buttons, all four forks, purged trees, machine otherwise idle. 8/8 green.	2026-07-31 17:53:31 +02:00