saymrwulf/dalek-ed25519-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/dalek-ed25519-verified.git synced 2026-09-03 20:13:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
dalek-ed25519-verified/verification/Proofs/Inventory.lean

91 lines
4.2 KiB
Text
Raw Normal View History

verification: pin the whole declaration surface (P1-b) Phase 2b asks the kernel whether any AXIOM is declared under Proofs/. Phase 3 pins the cones of the named certificates. Between them sat every other declaration in the corpus — around three thousand of them — and a helper lemma quietly acquiring a hash oracle in its cone moved nothing either phase looked at. Phase 2c closes that. Ported from ltl-accumulator-verified, where a nine-attack self-test proved a source-regex enumerator evadable by attributed, private, indented and `instance` declarations and by a nested-namespace basename collision. Reading the compiled environment sees what the kernel saw; no name shape hides. Every constant contributes module, name, kind and full axiom cone, and the observed set must equal inventory-allowlist.txt exactly in BOTH directions, with a count trailer so a truncated run cannot pass as an empty diff. FOUR THINGS THIS BUILD GOT WRONG, each caught by a check rather than by review: - The number of inventory drivers is a per-repo FACT, not an assumption. dalek and anza cannot import their corpus as one environment (Proofs.Basic and Proofs.ConstSpecs both declare CurveFieldProofs.zero_spec); risc0 and betrusted have no Proofs.Basic at all. Determined by compiling a probe. check.sh now DISCOVERS its drivers from the filesystem instead of naming two, and the generator refuses to split out a module the repo lacks. - The split let one real declaration hide behind another's entry. Keyed on name alone, the two zero_specs produced byte-identical records, so 3022 declarations were covered by 3021 allowlist entries. Caught by the count trailer. Every record now carries its originating module. - The gate's success line said "single sanctioned axiom", inherited from the accumulator's policy. This corpus permits NONE. A success message describing a different rule is how an assertion stops meaning anything. - selftest-axgate.sh lifted Phase 2b with a range ending at "Phase 3", so inserting Phase 2c between them made it swallow the new phase and die on variables only check.sh defines — surfacing as the BASELINE case failing, a self-test blaming a gate for its own extraction bug. Both self-tests now stop at the next phase marker whatever it is called, and refuse to run if they capture more than one phase. The guard is the fix; the range was the symptom. WHAT THIS IS NOT, recorded in TRUSTED-BASE.md at the same length as the claim: - No independent cone walker. The accumulator cross-checks collectAxioms against a hand-written walker. Ported here it was wrong in BOTH directions on mathlib's inductive shapes: EdPoint gave [] against the kernel's three axioms, and once extended, ProjPoint gave three against the kernel's none. Two implementations disagreeing both ways are a second wrong answer, not a check. These cones rest on collectAxioms alone. - Thirteen Proofs/Scalar* modules are inventoried by nothing — the second-button seam, still open. Phase 2c names every uncovered module on every run so the omission is visible rather than inferred. selftest-inventory.sh exercises the shipping gate with six cases, each asserting a specific diagnostic, including the one that matters: a cone widened by one oracle while name, module and kind stay put. Negative-tested by disabling the gate's diff, which turns two cases red including one for the wrong reason, correctly reported as such. Verified green: 20 runs across the four repositories (four buttons, four harness, four inventory, four axgate, four binding self-tests), zero red. The four check-scalar.sh greens from the preceding sweep stand: that script neither reads the pin file nor changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-29 23:20:15 +00:00
/- ──────────────────────────────────────────────────────────────────────────
Proofs/Inventory.lean — environment-derived declaration inventory (main chain).
Account for every constant the kernel sees, by set containment THE GAP. The capability matrix in the control repo — built after the author answered a capability question by grepping for a FILENAME rather than for the property, three times in one session — asked whether each repository's auditor enumerates itself. The four ed25519 forks answered no. Following that up found something larger: `Proofs/Audit.lean`, the statement-binding driver from P1-a, is compiled, is a member of the manifest, and was enumerated by NOTHING. The kernel counted 3058 declarations where the inventory accounted for 3022, and 26 of the 36 missing were its. THE PROPERTY, now enforced: every constant the kernel sees under this button's manifest must appear, BY NAME, in either the corpus inventory or the instruments' own surface. `emitDrivers` in InventoryCore walks the audit modules and fails closed on an axiom (which would widen the trusted base outside every cone) or on a standalone claim (which no certificate covers and no allowlist pins), while admitting the obligations the elaborator generates for a definition declared alongside it. TWO WRONG FORMULATIONS FIRST, both recorded because the second is instructive: · `kernel = corpus + instruments + N_DRIVERS`, where the last term was justified as a per-driver "self-observation blind spot". It fitted dalek and anza (2 drivers, residual 2) and broke on risc0 and betrusted (1 driver, residual 2). The residual is 2 everywhere and has nothing to do with drivers. This was curve-fitting from a sample of one, and it was named as the highest-risk claim in the round-7 self-assessment BEFORE the data refuted it. · distinct-by-name counting, which collapses `CurveFieldProofs.zero_spec` — a name that genuinely denotes two different declarations, in Proofs.Basic and Proofs.ConstSpecs, walked by two drivers with separate environments. THE MEASURED CAUSE of the residual. Lean materialises equation lemmas lazily, when something forces an unfold, and each module that forces one gets its own copy in its object file. `CurveFieldProofs.denote.eq_1` sits in both SubNegSpec.olean and ConstSpecs.olean; `CurveFieldProofs.limbsVal.eq_1` in both ReduceSpec.olean and ConstSpecs.olean. The kernel gate reads object files and counts both copies; the environment holds one constant per name. Counts cannot relate those two views in either direction — so the check compares SETS, which is the idiom the rest of this estate already uses, and no constant remains that could be widened to make a red run green. Negative-tested: with the instrument walk disabled, the check names Proofs.Audit's declarations as unaccounted. ANZA also lacked one allowlist row, `subtle.Choice...from.eq_1`, the same lazy-materialisation effect seen from the other side. Verified rather than assumed before adding it: the parent is declared in gen/CurveField/ FunsExternal.lean — the model, pinned by bytes and not inventoried by declaration — the lemma materialised in Proofs.CompressSpec which forced the unfold, and all three other forks carry the lemma row while none carries the parent. CONSEQUENCE WORTH DISCLOSING: the audited declaration surface is not purely a function of the corpus source. It depends on which proofs forced which unfolds. This is now a known gap in the round-7 kit. Also corrected here: Proofs/Inventory.lean's header claimed the audit drivers were excluded from the compile manifest. They are lines 42-44 of PROOFS. Certified by a full sweep: both buttons, all four forks, purged trees. 8/8.
2026-08-01 14:10:59 +00:00
Audit INFRASTRUCTURE, not corpus. It proves nothing and is imported by
nothing. It IS a member of check.sh's compile manifest — lines 42-44 of
PROOFS — so Phase 2b's kernel-side gate reads its `.olean` and an axiom
declared here is rejected. (An earlier version of this comment claimed the
drivers were excluded from the manifest. That was false, and the capability
matrix in the control repo found it on 2026-07-31.)
Its constants are outside the corpus walk below, and are emitted separately
by `emitDrivers` as DRV rows: the kernel counted 3058 declarations where the
inventory accounted for 3022, and those 36 are this machinery. check.sh now
requires the two walks to account for the kernel's count exactly.
verification: pin the whole declaration surface (P1-b) Phase 2b asks the kernel whether any AXIOM is declared under Proofs/. Phase 3 pins the cones of the named certificates. Between them sat every other declaration in the corpus — around three thousand of them — and a helper lemma quietly acquiring a hash oracle in its cone moved nothing either phase looked at. Phase 2c closes that. Ported from ltl-accumulator-verified, where a nine-attack self-test proved a source-regex enumerator evadable by attributed, private, indented and `instance` declarations and by a nested-namespace basename collision. Reading the compiled environment sees what the kernel saw; no name shape hides. Every constant contributes module, name, kind and full axiom cone, and the observed set must equal inventory-allowlist.txt exactly in BOTH directions, with a count trailer so a truncated run cannot pass as an empty diff. FOUR THINGS THIS BUILD GOT WRONG, each caught by a check rather than by review: - The number of inventory drivers is a per-repo FACT, not an assumption. dalek and anza cannot import their corpus as one environment (Proofs.Basic and Proofs.ConstSpecs both declare CurveFieldProofs.zero_spec); risc0 and betrusted have no Proofs.Basic at all. Determined by compiling a probe. check.sh now DISCOVERS its drivers from the filesystem instead of naming two, and the generator refuses to split out a module the repo lacks. - The split let one real declaration hide behind another's entry. Keyed on name alone, the two zero_specs produced byte-identical records, so 3022 declarations were covered by 3021 allowlist entries. Caught by the count trailer. Every record now carries its originating module. - The gate's success line said "single sanctioned axiom", inherited from the accumulator's policy. This corpus permits NONE. A success message describing a different rule is how an assertion stops meaning anything. - selftest-axgate.sh lifted Phase 2b with a range ending at "Phase 3", so inserting Phase 2c between them made it swallow the new phase and die on variables only check.sh defines — surfacing as the BASELINE case failing, a self-test blaming a gate for its own extraction bug. Both self-tests now stop at the next phase marker whatever it is called, and refuse to run if they capture more than one phase. The guard is the fix; the range was the symptom. WHAT THIS IS NOT, recorded in TRUSTED-BASE.md at the same length as the claim: - No independent cone walker. The accumulator cross-checks collectAxioms against a hand-written walker. Ported here it was wrong in BOTH directions on mathlib's inductive shapes: EdPoint gave [] against the kernel's three axioms, and once extended, ProjPoint gave three against the kernel's none. Two implementations disagreeing both ways are a second wrong answer, not a check. These cones rest on collectAxioms alone. - Thirteen Proofs/Scalar* modules are inventoried by nothing — the second-button seam, still open. Phase 2c names every uncovered module on every run so the omission is visible rather than inferred. selftest-inventory.sh exercises the shipping gate with six cases, each asserting a specific diagnostic, including the one that matters: a cone widened by one oracle while name, module and kind stay put. Negative-tested by disabling the gate's diff, which turns two cases red including one for the wrong reason, correctly reported as such. Verified green: 20 runs across the four repositories (four buttons, four harness, four inventory, four axgate, four binding self-tests), zero red. The four check-scalar.sh greens from the preceding sweep stand: that script neither reads the pin file nor changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-29 23:20:15 +00:00
Covers every module check.sh compiles except any listed as needing a
separate driver (see Proofs/InventoryBasic.lean if present). Whether
a split is needed was determined by compiling a probe, per repo.
────────────────────────────────────────────────────────────────────────── -/
import Proofs.InventoryCore
Account for every constant the kernel sees, by set containment THE GAP. The capability matrix in the control repo — built after the author answered a capability question by grepping for a FILENAME rather than for the property, three times in one session — asked whether each repository's auditor enumerates itself. The four ed25519 forks answered no. Following that up found something larger: `Proofs/Audit.lean`, the statement-binding driver from P1-a, is compiled, is a member of the manifest, and was enumerated by NOTHING. The kernel counted 3058 declarations where the inventory accounted for 3022, and 26 of the 36 missing were its. THE PROPERTY, now enforced: every constant the kernel sees under this button's manifest must appear, BY NAME, in either the corpus inventory or the instruments' own surface. `emitDrivers` in InventoryCore walks the audit modules and fails closed on an axiom (which would widen the trusted base outside every cone) or on a standalone claim (which no certificate covers and no allowlist pins), while admitting the obligations the elaborator generates for a definition declared alongside it. TWO WRONG FORMULATIONS FIRST, both recorded because the second is instructive: · `kernel = corpus + instruments + N_DRIVERS`, where the last term was justified as a per-driver "self-observation blind spot". It fitted dalek and anza (2 drivers, residual 2) and broke on risc0 and betrusted (1 driver, residual 2). The residual is 2 everywhere and has nothing to do with drivers. This was curve-fitting from a sample of one, and it was named as the highest-risk claim in the round-7 self-assessment BEFORE the data refuted it. · distinct-by-name counting, which collapses `CurveFieldProofs.zero_spec` — a name that genuinely denotes two different declarations, in Proofs.Basic and Proofs.ConstSpecs, walked by two drivers with separate environments. THE MEASURED CAUSE of the residual. Lean materialises equation lemmas lazily, when something forces an unfold, and each module that forces one gets its own copy in its object file. `CurveFieldProofs.denote.eq_1` sits in both SubNegSpec.olean and ConstSpecs.olean; `CurveFieldProofs.limbsVal.eq_1` in both ReduceSpec.olean and ConstSpecs.olean. The kernel gate reads object files and counts both copies; the environment holds one constant per name. Counts cannot relate those two views in either direction — so the check compares SETS, which is the idiom the rest of this estate already uses, and no constant remains that could be widened to make a red run green. Negative-tested: with the instrument walk disabled, the check names Proofs.Audit's declarations as unaccounted. ANZA also lacked one allowlist row, `subtle.Choice...from.eq_1`, the same lazy-materialisation effect seen from the other side. Verified rather than assumed before adding it: the parent is declared in gen/CurveField/ FunsExternal.lean — the model, pinned by bytes and not inventoried by declaration — the lemma materialised in Proofs.CompressSpec which forced the unfold, and all three other forks carry the lemma row while none carries the parent. CONSEQUENCE WORTH DISCLOSING: the audited declaration surface is not purely a function of the corpus source. It depends on which proofs forced which unfolds. This is now a known gap in the round-7 kit. Also corrected here: Proofs/Inventory.lean's header claimed the audit drivers were excluded from the compile manifest. They are lines 42-44 of PROOFS. Certified by a full sweep: both buttons, all four forks, purged trees. 8/8.
2026-08-01 14:10:59 +00:00
import Proofs.Audit
verification: pin the whole declaration surface (P1-b) Phase 2b asks the kernel whether any AXIOM is declared under Proofs/. Phase 3 pins the cones of the named certificates. Between them sat every other declaration in the corpus — around three thousand of them — and a helper lemma quietly acquiring a hash oracle in its cone moved nothing either phase looked at. Phase 2c closes that. Ported from ltl-accumulator-verified, where a nine-attack self-test proved a source-regex enumerator evadable by attributed, private, indented and `instance` declarations and by a nested-namespace basename collision. Reading the compiled environment sees what the kernel saw; no name shape hides. Every constant contributes module, name, kind and full axiom cone, and the observed set must equal inventory-allowlist.txt exactly in BOTH directions, with a count trailer so a truncated run cannot pass as an empty diff. FOUR THINGS THIS BUILD GOT WRONG, each caught by a check rather than by review: - The number of inventory drivers is a per-repo FACT, not an assumption. dalek and anza cannot import their corpus as one environment (Proofs.Basic and Proofs.ConstSpecs both declare CurveFieldProofs.zero_spec); risc0 and betrusted have no Proofs.Basic at all. Determined by compiling a probe. check.sh now DISCOVERS its drivers from the filesystem instead of naming two, and the generator refuses to split out a module the repo lacks. - The split let one real declaration hide behind another's entry. Keyed on name alone, the two zero_specs produced byte-identical records, so 3022 declarations were covered by 3021 allowlist entries. Caught by the count trailer. Every record now carries its originating module. - The gate's success line said "single sanctioned axiom", inherited from the accumulator's policy. This corpus permits NONE. A success message describing a different rule is how an assertion stops meaning anything. - selftest-axgate.sh lifted Phase 2b with a range ending at "Phase 3", so inserting Phase 2c between them made it swallow the new phase and die on variables only check.sh defines — surfacing as the BASELINE case failing, a self-test blaming a gate for its own extraction bug. Both self-tests now stop at the next phase marker whatever it is called, and refuse to run if they capture more than one phase. The guard is the fix; the range was the symptom. WHAT THIS IS NOT, recorded in TRUSTED-BASE.md at the same length as the claim: - No independent cone walker. The accumulator cross-checks collectAxioms against a hand-written walker. Ported here it was wrong in BOTH directions on mathlib's inductive shapes: EdPoint gave [] against the kernel's three axioms, and once extended, ProjPoint gave three against the kernel's none. Two implementations disagreeing both ways are a second wrong answer, not a check. These cones rest on collectAxioms alone. - Thirteen Proofs/Scalar* modules are inventoried by nothing — the second-button seam, still open. Phase 2c names every uncovered module on every run so the omission is visible rather than inferred. selftest-inventory.sh exercises the shipping gate with six cases, each asserting a specific diagnostic, including the one that matters: a cone widened by one oracle while name, module and kind stay put. Negative-tested by disabling the gate's diff, which turns two cases red including one for the wrong reason, correctly reported as such. Verified green: 20 runs across the four repositories (four buttons, four harness, four inventory, four axgate, four binding self-tests), zero red. The four check-scalar.sh greens from the preceding sweep stand: that script neither reads the pin file nor changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-29 23:20:15 +00:00
import Proofs.Denote
import Proofs.P25519
import Proofs.ReduceSpec
import Proofs.SubNegSpec
import Proofs.ConstSpecs
import Proofs.AddSpec
import Proofs.MulSpec
import Proofs.SquareSpec
import Proofs.Square2Spec
import Proofs.Field
import Proofs.InvertSpec
import Proofs.FieldMain
import Proofs.FeQ
import Proofs.EdCurve
import Proofs.EdDenote
import Proofs.EdDouble
import Proofs.EdAddProjNiels
import Proofs.EdAddAffNiels
import Proofs.EdConvert
import Proofs.EdMain
import Proofs.DsmTableSpec
import Proofs.DsmStepSpec
import Proofs.DsmLoopSpec
import Proofs.DsmNafLoadSpec
import Proofs.DsmNafMath
import Proofs.DsmNafLoopSpec
import Proofs.DsmNafSpec
import Proofs.DsmMulSpec
import Proofs.ToBytesMath
import Proofs.ToBytesSpec
import Proofs.CompressSpec
import Proofs.ScalarPackSpec
import Proofs.SigApexSpec
import Proofs.PointLiftSpec
import Proofs.PointEqSpec
import Proofs.DecompressSpec
import Proofs.FromBytesSpec
import Proofs.DecompressMain
open Lean Ed25519Inventory
/-- Exactly the modules this driver covers. check.sh verifies, in BOTH
directions, that the union of the two drivers' lists is its PROOFS
manifest minus the audit infrastructure. -/
def corpus : Array Name :=
#[`Proofs.Denote, `Proofs.P25519, `Proofs.ReduceSpec, `Proofs.SubNegSpec,
`Proofs.ConstSpecs, `Proofs.AddSpec, `Proofs.MulSpec,
`Proofs.SquareSpec, `Proofs.Square2Spec, `Proofs.Field,
`Proofs.InvertSpec, `Proofs.FieldMain, `Proofs.FeQ, `Proofs.EdCurve,
`Proofs.EdDenote, `Proofs.EdDouble, `Proofs.EdAddProjNiels,
`Proofs.EdAddAffNiels, `Proofs.EdConvert, `Proofs.EdMain,
`Proofs.DsmTableSpec, `Proofs.DsmStepSpec, `Proofs.DsmLoopSpec,
`Proofs.DsmNafLoadSpec, `Proofs.DsmNafMath, `Proofs.DsmNafLoopSpec,
`Proofs.DsmNafSpec, `Proofs.DsmMulSpec, `Proofs.ToBytesMath,
`Proofs.ToBytesSpec, `Proofs.CompressSpec, `Proofs.ScalarPackSpec,
`Proofs.SigApexSpec, `Proofs.PointLiftSpec, `Proofs.PointEqSpec,
`Proofs.DecompressSpec, `Proofs.FromBytesSpec, `Proofs.DecompressMain]
Account for every constant the kernel sees, by set containment THE GAP. The capability matrix in the control repo — built after the author answered a capability question by grepping for a FILENAME rather than for the property, three times in one session — asked whether each repository's auditor enumerates itself. The four ed25519 forks answered no. Following that up found something larger: `Proofs/Audit.lean`, the statement-binding driver from P1-a, is compiled, is a member of the manifest, and was enumerated by NOTHING. The kernel counted 3058 declarations where the inventory accounted for 3022, and 26 of the 36 missing were its. THE PROPERTY, now enforced: every constant the kernel sees under this button's manifest must appear, BY NAME, in either the corpus inventory or the instruments' own surface. `emitDrivers` in InventoryCore walks the audit modules and fails closed on an axiom (which would widen the trusted base outside every cone) or on a standalone claim (which no certificate covers and no allowlist pins), while admitting the obligations the elaborator generates for a definition declared alongside it. TWO WRONG FORMULATIONS FIRST, both recorded because the second is instructive: · `kernel = corpus + instruments + N_DRIVERS`, where the last term was justified as a per-driver "self-observation blind spot". It fitted dalek and anza (2 drivers, residual 2) and broke on risc0 and betrusted (1 driver, residual 2). The residual is 2 everywhere and has nothing to do with drivers. This was curve-fitting from a sample of one, and it was named as the highest-risk claim in the round-7 self-assessment BEFORE the data refuted it. · distinct-by-name counting, which collapses `CurveFieldProofs.zero_spec` — a name that genuinely denotes two different declarations, in Proofs.Basic and Proofs.ConstSpecs, walked by two drivers with separate environments. THE MEASURED CAUSE of the residual. Lean materialises equation lemmas lazily, when something forces an unfold, and each module that forces one gets its own copy in its object file. `CurveFieldProofs.denote.eq_1` sits in both SubNegSpec.olean and ConstSpecs.olean; `CurveFieldProofs.limbsVal.eq_1` in both ReduceSpec.olean and ConstSpecs.olean. The kernel gate reads object files and counts both copies; the environment holds one constant per name. Counts cannot relate those two views in either direction — so the check compares SETS, which is the idiom the rest of this estate already uses, and no constant remains that could be widened to make a red run green. Negative-tested: with the instrument walk disabled, the check names Proofs.Audit's declarations as unaccounted. ANZA also lacked one allowlist row, `subtle.Choice...from.eq_1`, the same lazy-materialisation effect seen from the other side. Verified rather than assumed before adding it: the parent is declared in gen/CurveField/ FunsExternal.lean — the model, pinned by bytes and not inventoried by declaration — the lemma materialised in Proofs.CompressSpec which forced the unfold, and all three other forks carry the lemma row while none carries the parent. CONSEQUENCE WORTH DISCLOSING: the audited declaration surface is not purely a function of the corpus source. It depends on which proofs forced which unfolds. This is now a known gap in the round-7 kit. Also corrected here: Proofs/Inventory.lean's header claimed the audit drivers were excluded from the compile manifest. They are lines 42-44 of PROOFS. Certified by a full sweep: both buttons, all four forks, purged trees. 8/8.
2026-08-01 14:10:59 +00:00
/-- The instruments. `Proofs.Audit` is the statement-binding driver: it is a
member of check.sh's compile manifest and it was enumerated by NOTHING —
26 of the 39 declarations the accounting identity found missing were its.
`Proofs.InventoryBasic` is reachable by module index only
if this driver imports it; it does not, so it emits its own DRV rows under
its own run and check.sh sums the two. This module has no index while it is
being elaborated, so `emitDrivers` picks its declarations up as the ones the
environment reports with no originating module. -/
def drivers : Array Name := #[`Proofs.InventoryCore, `Proofs.Audit]
verification: pin the whole declaration surface (P1-b) Phase 2b asks the kernel whether any AXIOM is declared under Proofs/. Phase 3 pins the cones of the named certificates. Between them sat every other declaration in the corpus — around three thousand of them — and a helper lemma quietly acquiring a hash oracle in its cone moved nothing either phase looked at. Phase 2c closes that. Ported from ltl-accumulator-verified, where a nine-attack self-test proved a source-regex enumerator evadable by attributed, private, indented and `instance` declarations and by a nested-namespace basename collision. Reading the compiled environment sees what the kernel saw; no name shape hides. Every constant contributes module, name, kind and full axiom cone, and the observed set must equal inventory-allowlist.txt exactly in BOTH directions, with a count trailer so a truncated run cannot pass as an empty diff. FOUR THINGS THIS BUILD GOT WRONG, each caught by a check rather than by review: - The number of inventory drivers is a per-repo FACT, not an assumption. dalek and anza cannot import their corpus as one environment (Proofs.Basic and Proofs.ConstSpecs both declare CurveFieldProofs.zero_spec); risc0 and betrusted have no Proofs.Basic at all. Determined by compiling a probe. check.sh now DISCOVERS its drivers from the filesystem instead of naming two, and the generator refuses to split out a module the repo lacks. - The split let one real declaration hide behind another's entry. Keyed on name alone, the two zero_specs produced byte-identical records, so 3022 declarations were covered by 3021 allowlist entries. Caught by the count trailer. Every record now carries its originating module. - The gate's success line said "single sanctioned axiom", inherited from the accumulator's policy. This corpus permits NONE. A success message describing a different rule is how an assertion stops meaning anything. - selftest-axgate.sh lifted Phase 2b with a range ending at "Phase 3", so inserting Phase 2c between them made it swallow the new phase and die on variables only check.sh defines — surfacing as the BASELINE case failing, a self-test blaming a gate for its own extraction bug. Both self-tests now stop at the next phase marker whatever it is called, and refuse to run if they capture more than one phase. The guard is the fix; the range was the symptom. WHAT THIS IS NOT, recorded in TRUSTED-BASE.md at the same length as the claim: - No independent cone walker. The accumulator cross-checks collectAxioms against a hand-written walker. Ported here it was wrong in BOTH directions on mathlib's inductive shapes: EdPoint gave [] against the kernel's three axioms, and once extended, ProjPoint gave three against the kernel's none. Two implementations disagreeing both ways are a second wrong answer, not a check. These cones rest on collectAxioms alone. - Thirteen Proofs/Scalar* modules are inventoried by nothing — the second-button seam, still open. Phase 2c names every uncovered module on every run so the omission is visible rather than inferred. selftest-inventory.sh exercises the shipping gate with six cases, each asserting a specific diagnostic, including the one that matters: a cone widened by one oracle while name, module and kind stay put. Negative-tested by disabling the gate's diff, which turns two cases red including one for the wrong reason, correctly reported as such. Verified green: 20 runs across the four repositories (four buttons, four harness, four inventory, four axgate, four binding self-tests), zero red. The four check-scalar.sh greens from the preceding sweep stand: that script neither reads the pin file nor changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-29 23:20:15 +00:00
#eval show MetaM Unit from emitInventory corpus
Account for every constant the kernel sees, by set containment THE GAP. The capability matrix in the control repo — built after the author answered a capability question by grepping for a FILENAME rather than for the property, three times in one session — asked whether each repository's auditor enumerates itself. The four ed25519 forks answered no. Following that up found something larger: `Proofs/Audit.lean`, the statement-binding driver from P1-a, is compiled, is a member of the manifest, and was enumerated by NOTHING. The kernel counted 3058 declarations where the inventory accounted for 3022, and 26 of the 36 missing were its. THE PROPERTY, now enforced: every constant the kernel sees under this button's manifest must appear, BY NAME, in either the corpus inventory or the instruments' own surface. `emitDrivers` in InventoryCore walks the audit modules and fails closed on an axiom (which would widen the trusted base outside every cone) or on a standalone claim (which no certificate covers and no allowlist pins), while admitting the obligations the elaborator generates for a definition declared alongside it. TWO WRONG FORMULATIONS FIRST, both recorded because the second is instructive: · `kernel = corpus + instruments + N_DRIVERS`, where the last term was justified as a per-driver "self-observation blind spot". It fitted dalek and anza (2 drivers, residual 2) and broke on risc0 and betrusted (1 driver, residual 2). The residual is 2 everywhere and has nothing to do with drivers. This was curve-fitting from a sample of one, and it was named as the highest-risk claim in the round-7 self-assessment BEFORE the data refuted it. · distinct-by-name counting, which collapses `CurveFieldProofs.zero_spec` — a name that genuinely denotes two different declarations, in Proofs.Basic and Proofs.ConstSpecs, walked by two drivers with separate environments. THE MEASURED CAUSE of the residual. Lean materialises equation lemmas lazily, when something forces an unfold, and each module that forces one gets its own copy in its object file. `CurveFieldProofs.denote.eq_1` sits in both SubNegSpec.olean and ConstSpecs.olean; `CurveFieldProofs.limbsVal.eq_1` in both ReduceSpec.olean and ConstSpecs.olean. The kernel gate reads object files and counts both copies; the environment holds one constant per name. Counts cannot relate those two views in either direction — so the check compares SETS, which is the idiom the rest of this estate already uses, and no constant remains that could be widened to make a red run green. Negative-tested: with the instrument walk disabled, the check names Proofs.Audit's declarations as unaccounted. ANZA also lacked one allowlist row, `subtle.Choice...from.eq_1`, the same lazy-materialisation effect seen from the other side. Verified rather than assumed before adding it: the parent is declared in gen/CurveField/ FunsExternal.lean — the model, pinned by bytes and not inventoried by declaration — the lemma materialised in Proofs.CompressSpec which forced the unfold, and all three other forks carry the lemma row while none carries the parent. CONSEQUENCE WORTH DISCLOSING: the audited declaration surface is not purely a function of the corpus source. It depends on which proofs forced which unfolds. This is now a known gap in the round-7 kit. Also corrected here: Proofs/Inventory.lean's header claimed the audit drivers were excluded from the compile manifest. They are lines 42-44 of PROOFS. Certified by a full sweep: both buttons, all four forks, purged trees. 8/8.
2026-08-01 14:10:59 +00:00
#eval show MetaM Unit from emitDrivers drivers
Reference in a new issue Copy permalink