(verify_accepts_iff_decompress, button-enforced)
Port of the risc0 decompress chain (identical v4 gen shape: same
instance naming, same RangeFrom+closure from_bytes extraction):
- source patch cee0e17: decompress step_2 negate-then-conditional-assign
(the documented sqrt_ratio_i rewrite); extract.sh: decompress
un-opaqued, re-extracted - the step_1/step_2 external axioms vanish
from the template, decompress is transparent.
- Proofs/DecompressSpec.lean: dalek port, instance rename
Shared0FieldElement51 -> SharedAFieldElement51.
- Proofs/FromBytesSpec.lean: the v4 closure-loader walk
(range_from_index_spec + closure_call_spec; window/telescope math
identical to dalek).
- Proofs/DecompressMain.lean: decompress_of_canonical (standard three)
+ verify_accepts_iff_decompress (corollary verbatim):
accept <=> decompress(R) = [k]*(-A) + [s]*B (as points).
check.sh: 4-tier Phase 3b; full-lift cone exactly [3 standard +
Signature + sha512_hash3 + to_bytes + Error + Error.new]. Full button
green fresh.
THE FULL POINT-LEVEL LIFT NOW HOLDS ON ALL FOUR PYRAMIDS.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replicates dalek's gen merge: extract.sh co-extracts the Scalar52 backend
and scalar::from_bytes_mod_order[_wide] into the CurveField model, pins
RUSTFLAGS --cfg curve25519_dalek_backend="serial" (SIMD dispatch compiles
out; get_selected_backend becomes a real definition), and upgrades
unwrap_u8 to the documented Choice-model definition. ScalarDenote repoints
by one import line; both buttons green over the merged gen.
Prepares the verify-glue integration (CurveSig) on this fork.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
extract.sh now opens crate::backend::serial::scalar_mul::vartime_double_base
(the other scalar_mul strategies stay opaque): non_adjacent_form (with its
loops), NafLookupTable5 (from/select), the curve-model helpers and
vartime_double_base::mul itself land in gen/CurveField - the same
namespace as the proven edwards operations, so the coming double-and-add
induction can consume EdDouble/EdAddProjNiels/EdConvert directly.
Zero sorries, zero external axioms (the pinned sources carry documented
compat refactors: single-assignment loop helpers, param-rooted while,
always-256-iterations, index-based LE load).
Full check.sh pressed fresh over the regenerated model: every existing
field and group-law certificate still green and axiom-clean - the scope
extension is purely additive.
Ported from the locally verified Hermes working copy; FeQ and Square2Spec
(dead files in the published replica) now compile and are in the check
manifest. Basic.lean (never compiled under v4 Aeneas) removed rather than
shipped dead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
