Merge scalar into CurveField; integrate the verify glue against the model

Gen merge: extract.sh now co-extracts the Scalar52 backend and the public
scalar::from_bytes_mod_order[_wide] conversions into the SAME CurveField
model, so the whole library — field, curve_models, edwards, scalar — shares
one type universe (Scalar is a single structure, not two). The scalar proof
chain repoints by one import line (ScalarDenote: CurveScalar.Funs ->
CurveField.Funs); check-scalar.sh's gen list follows. Both buttons — the
scalar certificates and the field/group/dsm certificates — pass fresh over
the merged gen, so the merge is proven-safe, not merely hoped-safe.

Verify glue (gen/CurveSig): the extracted ed25519-dalek verify_sha512 path,
integrated against the proven model:
- TypesExternal.lean imports CurveField.Types, so CompressedEdwardsY /
  EdwardsPoint / Scalar in the glue ARE the proven model's types. Only the
  genuinely foreign types stay opaque: sha2.Sha512, ed25519.Signature,
  signature.error.Error.
- FunsExternal.lean imports CurveField.Funs, so every curve/scalar call
  (compress, vartime_double_scalar_mul_basepoint, as_bytes, neg,
  from_bytes_mod_order[_wide]) resolves to a proven definition — no axioms.
  The `?`-operator plumbing (Try::branch, FromResidual::from_residual) and
  compressed_from_bytes get real definitions. Only the SHA-512 hasher
  (sha512_new/update/finalize_bytes) and two opaque wire accessors
  (Signature.to_bytes, Error.new) remain axiomatized — the deliberate,
  documented hash-oracle boundary.

Audited: `verify_sha512`'s entire axiom cone is
  [propext, Classical.choice, Quot.sound,
   sha2.Sha512, sha512_new, sha512_update, sha512_finalize_bytes,
   ed25519.Signature.to_bytes, signature.error.Error.new]
— zero curve axioms, zero scalar axioms. The verify path is definitionally
grounded in the certified model; the only trust boundary is SHA-512.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

verification/Proofs/ScalarDenote.lean

@@ -23,7 +23,7 @@
 
    Imports: gen/CurveScalar (the transpiled Scalar52 arithmetic).
    ────────────────────────────────────────────────────────────────────────────── -/
-import CurveScalar.Funs
+import CurveField.Funs
 open Aeneas Aeneas.Std Result
 open curve25519_dalek
 

verification/check-scalar.sh

@@ -6,7 +6,7 @@ set -uo pipefail
 source ~/aeneas-toolchain/env.sh
 HERE="$(cd "$(dirname "$0")" && pwd)"
 AENEAS_LEAN="$AENEAS_HOME/backends/lean"
-GEN=(CurveScalar/TypesExternal CurveScalar/Types CurveScalar/FunsExternal CurveScalar/Funs)
+GEN=(CurveField/TypesExternal CurveField/Types CurveField/FunsExternal CurveField/Funs)  # MERGED GEN: scalar module now lives in CurveField
 PROOFS=(ScalarDenote ScalarLoop ScalarSubSpec ScalarAddSpec ScalarMulSpec ScalarMontSpec ScalarReduceSpec ScalarFullMulSpec ScalarMain ScalarWideSpec ScalarBytesSpec ScalarUnpackSpec ScalarFromBytesSpec)
 
 echo "=== stub/axiom audit ==="

verification/extract.sh

@@ -23,13 +23,26 @@ source ~/aeneas-toolchain/env.sh
 HERE="$(cd "$(dirname "$0")" && pwd)"
 CRATE=~/GitClone/FormalVerification/sources/curve25519-dalek-source/curve25519-dalek
 
-echo "[1/2] charon: Rust -> LLBC (field + curve_models + edwards)"
+echo "[1/2] charon: Rust -> LLBC (field + curve_models + edwards + scalar [MERGED GEN])"
 cd "$CRATE"
 charon cargo --preset=aeneas \
   --start-from crate::field \
   --start-from crate::backend::serial::u64::field \
   --start-from crate::backend::serial::curve_models \
   --start-from crate::edwards \
+  --start-from 'crate::backend::serial::u64::scalar::_::add' \
+  --start-from 'crate::backend::serial::u64::scalar::_::sub' \
+  --start-from 'crate::backend::serial::u64::scalar::_::mul' \
+  --start-from 'crate::backend::serial::u64::scalar::_::square' \
+  --start-from 'crate::backend::serial::u64::scalar::_::montgomery_mul' \
+  --start-from 'crate::backend::serial::u64::scalar::_::montgomery_square' \
+  --start-from 'crate::backend::serial::u64::scalar::_::montgomery_reduce' \
+  --start-from 'crate::backend::serial::u64::scalar::_::montgomery_invert' \
+  --start-from 'crate::backend::serial::u64::scalar::_::as_montgomery' \
+  --start-from 'crate::backend::serial::u64::scalar::_::from_montgomery' \
+  --start-from 'crate::backend::serial::u64::scalar::_::from_bytes_wide' \
+  --start-from 'crate::scalar::_::from_bytes_mod_order' \
+  --start-from 'crate::scalar::_::from_bytes_mod_order_wide' \
   --opaque 'crate::field::_::internal_invert_batch' \
   --opaque 'crate::backend::serial::scalar_mul::variable_base' \
   --opaque 'crate::backend::serial::scalar_mul::straus' \

verification/gen/CurveField/Types.lean

@@ -180,6 +180,12 @@ structure scalar.Scalar where
 @[reducible]
 def window.NafLookupTable5 (T : Type) := Array T 8#usize
 
+/-- [curve25519_dalek::backend::serial::u64::scalar::Scalar52]
+    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 26:0-26:34
+    Visibility: public -/
+@[reducible]
+def backend.serial.u64.scalar.Scalar52 := Array Std.U64 5#usize
+
 /-- [curve25519_dalek::backend::BackendKind]
     Source: 'curve25519-dalek/src/backend.rs', lines 46:0-52:1 -/
 @[discriminant isize]

verification/gen/CurveSig/Funs.lean

@@ -0,0 +1,261 @@
+-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS
+-- [ed25519_dalek]: function definitions
+import Aeneas
+import CurveSig.Types
+import CurveSig.FunsExternal
+open Aeneas Aeneas.Std Result ControlFlow Error
+set_option linter.dupNamespace false
+set_option linter.hashCommand false
+set_option linter.unusedVariables false
+
+/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/
+set_option maxHeartbeats 1000000
+
+/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/
+set_option maxRecDepth 2048
+
+/- You can remove the following line by using the CLI option `-all-computable`: -/
+noncomputable section
+
+namespace ed25519_dalek
+
+/-- [ed25519_dalek::errors::{impl core::convert::From<ed25519_dalek::errors::InternalError> for signature::error::Error}::from]:
+    Source: 'ed25519-dalek/src/errors.rs', lines 108:4-110:5
+    Visibility: public -/
+def signature.error.Error.Insts.CoreConvertFromInternalError.from
+  (_err : errors.InternalError) : Result signature.error.Error := do
+  signature.error.Error.new
+
+/-- Trait implementation: [ed25519_dalek::errors::{impl core::convert::From<ed25519_dalek::errors::InternalError> for signature::error::Error}]
+    Source: 'ed25519-dalek/src/errors.rs', lines 106:0-116:1 -/
+@[reducible]
+def signature.error.Error.Insts.CoreConvertFromInternalError :
+  core.convert.From signature.error.Error errors.InternalError := {
+  from_ := signature.error.Error.Insts.CoreConvertFromInternalError.from
+}
+
+/-- [ed25519_dalek::signature::check_scalar::L_BYTES]
+    Source: 'ed25519-dalek/src/signature.rs', lines 106:4-109:6 -/
+@[global_simps, irreducible]
+def signature.check_scalar.L_BYTES : Array Std.U8 32#usize :=
+  Array.make 32#usize [
+    237#u8, 211#u8, 245#u8, 92#u8, 26#u8, 99#u8, 18#u8, 88#u8, 214#u8, 156#u8,
+    247#u8, 162#u8, 222#u8, 249#u8, 222#u8, 20#u8, 0#u8, 0#u8, 0#u8, 0#u8,
+    0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 16#u8
+    ]
+
+/-- [ed25519_dalek::signature::check_scalar]: loop body 0:
+    Source: 'ed25519-dalek/src/signature.rs', lines 114:4-125:5 -/
+@[rust_loop_body]
+def signature.check_scalar_loop.body
+  (bytes : Array Std.U8 32#usize) (lt : Bool) (decided : Bool) (i : Std.Usize)
+  :
+  Result (ControlFlow (Bool × Bool × Std.Usize) Bool)
+  := do
+  if i > 0#usize
+  then
+    let j ← i - 1#usize
+    let (lt1, decided1) ←
+      if decided
+      then ok (lt, true)
+      else
+        do
+        let i1 ← Array.index_usize bytes j
+        let i2 ← Array.index_usize signature.check_scalar.L_BYTES j
+        if i1 < i2
+        then ok (true, true)
+        else let b ← if i1 > i2
+                       then ok true
+                       else ok false
+             ok (lt, b)
+    ok (cont (lt1, decided1, j))
+  else ok (done lt)
+
+/-- [ed25519_dalek::signature::check_scalar]: loop 0:
+    Source: 'ed25519-dalek/src/signature.rs', lines 114:4-125:5 -/
+@[rust_loop]
+def signature.check_scalar_loop
+  (bytes : Array Std.U8 32#usize) (lt : Bool) (decided : Bool) (i : Std.Usize)
+  :
+  Result Bool
+  := do
+  loop
+    (fun (lt1, decided1, i1) => signature.check_scalar_loop.body bytes lt1
+      decided1 i1)
+    (lt, decided, i)
+
+/-- [ed25519_dalek::signature::check_scalar]:
+    Source: 'ed25519-dalek/src/signature.rs', lines 104:0-131:1 -/
+def signature.check_scalar
+  (bytes : Array Std.U8 32#usize) :
+  Result (core.result.Result curve25519_dalek.scalar.Scalar
+    signature.error.Error)
+  := do
+  let lt ← signature.check_scalar_loop bytes false false 32#usize
+  if lt
+  then
+    let s ← curve25519_dalek.scalar.Scalar.from_bytes_mod_order bytes
+    ok (core.result.Result.Ok s)
+  else
+    let e ←
+      core.convert.IntoFrom.into
+        signature.error.Error.Insts.CoreConvertFromInternalError
+        errors.InternalError.ScalarFormat
+    ok (core.result.Result.Err e)
+
+/-- [ed25519_dalek::signature::{ed25519_dalek::signature::InternalSignature}::from_bytes]: loop body 0:
+    Source: 'ed25519-dalek/src/signature.rs', lines 194:8-198:9
+    Visibility: public -/
+@[rust_loop_body]
+def signature.InternalSignature.from_bytes_loop.body
+  (bytes : Array Std.U8 64#usize) (R_bytes : Array Std.U8 32#usize)
+  (s_bytes : Array Std.U8 32#usize) (i : Std.Usize) :
+  Result (ControlFlow ((Array Std.U8 32#usize) × (Array Std.U8 32#usize) ×
+    Std.Usize) ((Array Std.U8 32#usize) × (Array Std.U8 32#usize)))
+  := do
+  if i < 32#usize
+  then
+    let i1 ← Array.index_usize bytes i
+    let a ← Array.update R_bytes i i1
+    let i2 ← i + 32#usize
+    let i3 ← Array.index_usize bytes i2
+    let a1 ← Array.update s_bytes i i3
+    let i4 ← i + 1#usize
+    ok (cont (a, a1, i4))
+  else ok (done (R_bytes, s_bytes))
+
+/-- [ed25519_dalek::signature::{ed25519_dalek::signature::InternalSignature}::from_bytes]: loop 0:
+    Source: 'ed25519-dalek/src/signature.rs', lines 194:8-198:9
+    Visibility: public -/
+@[rust_loop]
+def signature.InternalSignature.from_bytes_loop
+  (bytes : Array Std.U8 64#usize) (R_bytes : Array Std.U8 32#usize)
+  (s_bytes : Array Std.U8 32#usize) (i : Std.Usize) :
+  Result ((Array Std.U8 32#usize) × (Array Std.U8 32#usize))
+  := do
+  loop
+    (fun (R_bytes1, s_bytes1, i1) =>
+      signature.InternalSignature.from_bytes_loop.body bytes R_bytes1 s_bytes1
+      i1)
+    (R_bytes, s_bytes, i)
+
+/-- [ed25519_dalek::signature::{ed25519_dalek::signature::InternalSignature}::from_bytes]:
+    Source: 'ed25519-dalek/src/signature.rs', lines 186:4-204:5
+    Visibility: public -/
+def signature.InternalSignature.from_bytes
+  (bytes : Array Std.U8 64#usize) :
+  Result (core.result.Result signature.InternalSignature signature.error.Error)
+  := do
+  let R_bytes := Array.repeat 32#usize 0#u8
+  let s_bytes := Array.repeat 32#usize 0#u8
+  let (R_bytes1, s_bytes1) ←
+    signature.InternalSignature.from_bytes_loop bytes R_bytes s_bytes 0#usize
+  let cey ← signature.compressed_from_bytes R_bytes1
+  let r ← signature.check_scalar s_bytes1
+  let cf ← core.result.Result.Insts.CoreOpsTry_traitTry.branch r
+  match cf with
+  | core.ops.control_flow.ControlFlow.Continue val =>
+    ok (core.result.Result.Ok { R := cey, s := val })
+  | core.ops.control_flow.ControlFlow.Break residual =>
+    core.result.Result.Insts.CoreOpsTry_traitFromResidualResultInfallibleE.from_residual
+      signature.InternalSignature (core.convert.FromSame signature.error.Error)
+      residual
+
+/-- [ed25519_dalek::signature::{impl core::convert::TryFrom<&'_0 ed25519::Signature, signature::error::Error> for ed25519_dalek::signature::InternalSignature}::try_from]:
+    Source: 'ed25519-dalek/src/signature.rs', lines 210:4-212:5
+    Visibility: public -/
+def
+  signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from
+  (sig : ed25519.Signature) :
+  Result (core.result.Result signature.InternalSignature signature.error.Error)
+  := do
+  let a ← ed25519.Signature.to_bytes sig
+  signature.InternalSignature.from_bytes a
+
+/-- [ed25519_dalek::verifying::recompute_r_sha512]:
+    Source: 'ed25519-dalek/src/verifying.rs', lines 784:0-797:1 -/
+def verifying.recompute_r_sha512
+  (key : verifying.VerifyingKey) (sig : signature.InternalSignature)
+  (message : Slice Std.U8) :
+  Result curve25519_dalek.edwards.CompressedEdwardsY
+  := do
+  let h ← verifying.sha512_new
+  let a ← curve25519_dalek.edwards.CompressedEdwardsY.as_bytes sig.R
+  let s ← lift (Array.to_slice a)
+  let h1 ← verifying.sha512_update h s
+  let a1 ←
+    curve25519_dalek.edwards.CompressedEdwardsY.as_bytes key.compressed
+  let s1 ← lift (Array.to_slice a1)
+  let h2 ← verifying.sha512_update h1 s1
+  let h3 ← verifying.sha512_update h2 message
+  let a2 ← verifying.sha512_finalize_bytes h3
+  let k ← curve25519_dalek.scalar.Scalar.from_bytes_mod_order_wide a2
+  let minus_A ←
+    curve25519_dalek.edwards.EdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint.neg
+      key.point
+  let ep ←
+    curve25519_dalek.edwards.EdwardsPoint.vartime_double_scalar_mul_basepoint k
+      minus_A sig.s
+  curve25519_dalek.edwards.EdwardsPoint.compress ep
+
+/-- [ed25519_dalek::verifying::verify_sha512]: loop body 0:
+    Source: 'ed25519-dalek/src/verifying.rs', lines 816:4-821:5 -/
+@[rust_loop_body]
+def verifying.verify_sha512_loop.body
+  (e : Array Std.U8 32#usize) (r : Array Std.U8 32#usize) (equal : Bool)
+  (i : Std.Usize) :
+  Result (ControlFlow (Bool × Std.Usize) Bool)
+  := do
+  if i < 32#usize
+  then
+    let i1 ← Array.index_usize e i
+    let i2 ← Array.index_usize r i
+    let equal1 ← if i1 != i2
+                   then ok false
+                   else ok equal
+    let i3 ← i + 1#usize
+    ok (cont (equal1, i3))
+  else ok (done equal)
+
+/-- [ed25519_dalek::verifying::verify_sha512]: loop 0:
+    Source: 'ed25519-dalek/src/verifying.rs', lines 816:4-821:5 -/
+@[rust_loop]
+def verifying.verify_sha512_loop
+  (e : Array Std.U8 32#usize) (r : Array Std.U8 32#usize) (equal : Bool)
+  (i : Std.Usize) :
+  Result Bool
+  := do
+  loop
+    (fun (equal1, i1) => verifying.verify_sha512_loop.body e r equal1 i1)
+    (equal, i)
+
+/-- [ed25519_dalek::verifying::verify_sha512]:
+    Source: 'ed25519-dalek/src/verifying.rs', lines 800:0-827:1 -/
+def verifying.verify_sha512
+  (key : verifying.VerifyingKey) (message : Slice Std.U8)
+  (sig : ed25519.Signature) :
+  Result (core.result.Result Unit signature.error.Error)
+  := do
+  let r ←
+    signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from
+      sig
+  let cf ← core.result.Result.Insts.CoreOpsTry_traitTry.branch r
+  match cf with
+  | core.ops.control_flow.ControlFlow.Continue val =>
+    let expected_R ← verifying.recompute_r_sha512 key val message
+    let e ← curve25519_dalek.edwards.CompressedEdwardsY.as_bytes expected_R
+    let r1 ← curve25519_dalek.edwards.CompressedEdwardsY.as_bytes val.R
+    let equal ← verifying.verify_sha512_loop e r1 true 0#usize
+    if equal
+    then ok (core.result.Result.Ok ())
+    else
+      let e1 ←
+        core.convert.IntoFrom.into
+          signature.error.Error.Insts.CoreConvertFromInternalError
+          errors.InternalError.Verify
+      ok (core.result.Result.Err e1)
+  | core.ops.control_flow.ControlFlow.Break residual =>
+    core.result.Result.Insts.CoreOpsTry_traitFromResidualResultInfallibleE.from_residual
+      Unit (core.convert.FromSame signature.error.Error) residual
+
+end ed25519_dalek

verification/gen/CurveSig/FunsExternal.lean

@@ -0,0 +1,75 @@
+/- ──────────────────────────────────────────────────────────────────────────────
+   gen/CurveSig/FunsExternal.lean — external functions for the verify glue.
+
+   TIER A/B — REAL DEFINITIONS (no axioms): importing CurveField.Funs makes
+   the curve calls (compress, vartime_double_scalar_mul_basepoint,
+   as_bytes, neg, from_bytes_mod_order, from_bytes_mod_order_wide) resolve to
+   the PROVEN model's definitions by their fully-qualified names. The Result
+   Try/FromResidual plumbing and the compressed_from_bytes constructor are
+   given real definitions below.
+
+   TIER C — THE DELIBERATE OPAQUE BOUNDARY (the only axioms):
+   · verifying.sha512_new / sha512_update / sha512_finalize_bytes — SHA-512
+   · ed25519.Signature.to_bytes — the wire accessor of an opaque type
+   · signature.error.Error.new  — an opaque error value
+   The apex certificate will carry EXACTLY these axioms beyond the standard
+   three — the documented hash-oracle boundary.
+   ────────────────────────────────────────────────────────────────────────────── -/
+import Aeneas
+import CurveSig.TypesExternal
+import CurveField.Funs
+open Aeneas Aeneas.Std Result ControlFlow Error
+set_option linter.dupNamespace false
+set_option linter.hashCommand false
+set_option linter.unusedVariables false
+
+/-! ### Tier A/B: real definitions -/
+
+/-- `Try::branch` for `core::result::Result` — the `?` operator's dispatch. -/
+def core.result.Result.Insts.CoreOpsTry_traitTry.branch
+    {T : Type} {E : Type} (r : core.result.Result T E) :
+    Result (core.ops.control_flow.ControlFlow
+      (core.result.Result core.convert.Infallible E) T) :=
+  match r with
+  | .Ok v => ok (.Continue v)
+  | .Err e => ok (.Break (.Err e))
+
+/-- `FromResidual` for `core::result::Result` — the `?` operator's error
+    conversion. The `Ok Infallible` branch is uninhabited. -/
+def core.result.Result.Insts.CoreOpsTry_traitFromResidualResultInfallibleE.from_residual
+    (T : Type) {E : Type} {F : Type} (convertFromInst : core.convert.From F E)
+    (r : core.result.Result core.convert.Infallible E) :
+    Result (core.result.Result T F) :=
+  match r with
+  | .Ok v => nomatch v
+  | .Err e => do
+      let f ← convertFromInst.from_ e
+      ok (.Err f)
+
+/-- The compressed-point constructor: `CompressedEdwardsY` is the 32-byte
+    array synonym in the proven model. -/
+def signature.compressed_from_bytes
+    (bytes : Array Std.U8 32#usize) :
+    Result curve25519_dalek.edwards.CompressedEdwardsY :=
+  ok bytes
+
+/-! ### Tier C: the deliberate opaque boundary -/
+
+/-- SHA-512: fresh hasher state. OPAQUE BY DESIGN. -/
+axiom verifying.sha512_new : Result sha2.Sha512
+
+/-- SHA-512: absorb bytes. OPAQUE BY DESIGN. -/
+axiom verifying.sha512_update
+  : sha2.Sha512 → Slice Std.U8 → Result sha2.Sha512
+
+/-- SHA-512: finalize to 64 bytes. OPAQUE BY DESIGN. -/
+axiom verifying.sha512_finalize_bytes
+  : sha2.Sha512 → Result (Array Std.U8 64#usize)
+
+/-- The wire signature's 64 bytes (R ‖ s). Opaque accessor of an opaque
+    type — the verify spec is stated relative to its result. -/
+axiom ed25519.Signature.to_bytes
+  : ed25519.Signature → Result (Array Std.U8 64#usize)
+
+/-- An opaque error value; the spec only distinguishes ok from err. -/
+axiom signature.error.Error.new : Result signature.error.Error

verification/gen/CurveSig/FunsExternal_Template.lean

@@ -0,0 +1,139 @@
+-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS
+-- [ed25519_dalek]: external functions.
+-- This is a template file: rename it to "FunsExternal.lean" and fill the holes.
+import Aeneas
+import CurveSig.Types
+open Aeneas Aeneas.Std Result ControlFlow Error
+set_option linter.dupNamespace false
+set_option linter.hashCommand false
+set_option linter.unusedVariables false
+
+/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/
+set_option maxHeartbeats 1000000
+
+/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/
+set_option maxRecDepth 2048
+open ed25519_dalek
+
+/-- [core::result::{impl core::ops::try_trait::Try for core::result::Result<T, E>}::branch]:
+    Source: '/rustc/library/core/src/result.rs', lines 2177:4-2177:64
+    Name pattern: [core::result::{core::ops::try_trait::Try<core::result::Result<@T, @E>>}::branch]
+    Visibility: public -/
+@[rust_fun
+  "core::result::{core::ops::try_trait::Try<core::result::Result<@T, @E>>}::branch"]
+axiom core.result.Result.Insts.CoreOpsTry_traitTry.branch
+  {T : Type} {E : Type} :
+  core.result.Result T E → Result (core.ops.control_flow.ControlFlow
+    (core.result.Result core.convert.Infallible E) T)
+
+/-- [core::result::{impl core::ops::try_trait::FromResidual<core::result::Result<core::convert::Infallible, E>> for core::result::Result<T, F>}::from_residual]:
+    Source: '/rustc/library/core/src/result.rs', lines 2192:4-2192:70
+    Name pattern: [core::result::{core::ops::try_trait::FromResidual<core::result::Result<@T, @F>, core::result::Result<core::convert::Infallible, @E>>}::from_residual]
+    Visibility: public -/
+@[rust_fun
+  "core::result::{core::ops::try_trait::FromResidual<core::result::Result<@T, @F>, core::result::Result<core::convert::Infallible, @E>>}::from_residual"]
+axiom
+  core.result.Result.Insts.CoreOpsTry_traitFromResidualResultInfallibleE.from_residual
+  (T : Type) {E : Type} {F : Type} (convertFromInst : core.convert.From F E) :
+  core.result.Result core.convert.Infallible E → Result (core.result.Result T
+    F)
+
+/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::CompressedEdwardsY}::as_bytes]:
+    Source: 'curve25519-dalek/src/edwards.rs', lines 198:4-198:45
+    Name pattern: [curve25519_dalek::edwards::{curve25519_dalek::edwards::CompressedEdwardsY}::as_bytes]
+    Visibility: public -/
+@[rust_fun
+  "curve25519_dalek::edwards::{curve25519_dalek::edwards::CompressedEdwardsY}::as_bytes"]
+axiom curve25519_dalek.edwards.CompressedEdwardsY.as_bytes
+  :
+  curve25519_dalek.edwards.CompressedEdwardsY → Result (Array Std.U8
+    32#usize)
+
+/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::compress]:
+    Source: 'curve25519-dalek/src/edwards.rs', lines 615:4-615:48
+    Name pattern: [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::compress]
+    Visibility: public -/
+@[rust_fun
+  "curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::compress"]
+axiom curve25519_dalek.edwards.EdwardsPoint.compress
+  :
+  curve25519_dalek.edwards.EdwardsPoint → Result
+    curve25519_dalek.edwards.CompressedEdwardsY
+
+/-- [curve25519_dalek::edwards::{impl core::ops::arith::Neg<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::neg]:
+    Source: 'curve25519-dalek/src/edwards.rs', lines 869:4-869:32
+    Name pattern: [curve25519_dalek::edwards::{core::ops::arith::Neg<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint>}::neg]
+    Visibility: public -/
+@[rust_fun
+  "curve25519_dalek::edwards::{core::ops::arith::Neg<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint>}::neg"]
+axiom
+  curve25519_dalek.edwards.EdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint.neg
+  :
+  curve25519_dalek.edwards.EdwardsPoint → Result
+    curve25519_dalek.edwards.EdwardsPoint
+
+/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::vartime_double_scalar_mul_basepoint]:
+    Source: 'curve25519-dalek/src/edwards.rs', lines 1080:4-1084:21
+    Name pattern: [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::vartime_double_scalar_mul_basepoint]
+    Visibility: public -/
+@[rust_fun
+  "curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::vartime_double_scalar_mul_basepoint"]
+axiom curve25519_dalek.edwards.EdwardsPoint.vartime_double_scalar_mul_basepoint
+  :
+  curve25519_dalek.scalar.Scalar → curve25519_dalek.edwards.EdwardsPoint →
+    curve25519_dalek.scalar.Scalar → Result
+    curve25519_dalek.edwards.EdwardsPoint
+
+/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::from_bytes_mod_order]:
+    Source: 'curve25519-dalek/src/scalar.rs', lines 235:4-235:58
+    Name pattern: [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::from_bytes_mod_order]
+    Visibility: public -/
+@[rust_fun
+  "curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::from_bytes_mod_order"]
+axiom curve25519_dalek.scalar.Scalar.from_bytes_mod_order
+  : Array Std.U8 32#usize → Result curve25519_dalek.scalar.Scalar
+
+/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::from_bytes_mod_order_wide]:
+    Source: 'curve25519-dalek/src/scalar.rs', lines 248:4-248:64
+    Name pattern: [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::from_bytes_mod_order_wide]
+    Visibility: public -/
+@[rust_fun
+  "curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::from_bytes_mod_order_wide"]
+axiom curve25519_dalek.scalar.Scalar.from_bytes_mod_order_wide
+  : Array Std.U8 64#usize → Result curve25519_dalek.scalar.Scalar
+
+/-- [ed25519::{ed25519::Signature}::to_bytes]:
+    Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-3.0.0/src/lib.rs', lines 368:4-368:44
+    Name pattern: [ed25519::{ed25519::Signature}::to_bytes]
+    Visibility: public -/
+@[rust_fun "ed25519::{ed25519::Signature}::to_bytes"]
+axiom ed25519.Signature.to_bytes
+  : ed25519.Signature → Result (Array Std.U8 64#usize)
+
+/-- [signature::error::{signature::error::Error}::new]:
+    Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/signature-3.0.0/src/error.rs', lines 34:4-34:24
+    Name pattern: [signature::error::{signature::error::Error}::new]
+    Visibility: public -/
+@[rust_fun "signature::error::{signature::error::Error}::new"]
+axiom signature.error.Error.new : Result signature.error.Error
+
+/-- [ed25519_dalek::signature::compressed_from_bytes]:
+    Source: 'ed25519-dalek/src/signature.rs', lines 69:0-71:1 -/
+axiom signature.compressed_from_bytes
+  :
+  Array Std.U8 32#usize → Result curve25519_dalek.edwards.CompressedEdwardsY
+
+/-- [ed25519_dalek::verifying::sha512_new]:
+    Source: 'ed25519-dalek/src/verifying.rs', lines 771:0-773:1 -/
+axiom verifying.sha512_new : Result sha2.Sha512
+
+/-- [ed25519_dalek::verifying::sha512_update]:
+    Source: 'ed25519-dalek/src/verifying.rs', lines 775:0-777:1 -/
+axiom verifying.sha512_update
+  : sha2.Sha512 → Slice Std.U8 → Result sha2.Sha512
+
+/-- [ed25519_dalek::verifying::sha512_finalize_bytes]:
+    Source: 'ed25519-dalek/src/verifying.rs', lines 779:0-781:1 -/
+axiom verifying.sha512_finalize_bytes
+  : sha2.Sha512 → Result (Array Std.U8 64#usize)
+

verification/gen/CurveSig/Types.lean

@@ -0,0 +1,41 @@
+-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS
+-- [ed25519_dalek]: type definitions
+import Aeneas
+import CurveSig.TypesExternal
+open Aeneas Aeneas.Std Result ControlFlow Error
+set_option linter.dupNamespace false
+set_option linter.hashCommand false
+set_option linter.unusedVariables false
+
+/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/
+set_option maxHeartbeats 1000000
+
+/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/
+set_option maxRecDepth 2048
+
+namespace ed25519_dalek
+
+/-- [ed25519_dalek::errors::InternalError]
+    Source: 'ed25519-dalek/src/errors.rs', lines 23:0-53:1 -/
+@[discriminant isize]
+inductive errors.InternalError where
+| PointDecompression : errors.InternalError
+| ScalarFormat : errors.InternalError
+| BytesLength : Str → Std.Usize → errors.InternalError
+| Verify : errors.InternalError
+| MismatchedKeypair : errors.InternalError
+
+/-- [ed25519_dalek::signature::InternalSignature]
+    Source: 'ed25519-dalek/src/signature.rs', lines 29:0-51:1 -/
+structure signature.InternalSignature where
+  R : curve25519_dalek.edwards.CompressedEdwardsY
+  s : curve25519_dalek.scalar.Scalar
+
+/-- [ed25519_dalek::verifying::VerifyingKey]
+    Source: 'ed25519-dalek/src/verifying.rs', lines 65:0-71:1
+    Visibility: public -/
+structure verifying.VerifyingKey where
+  compressed : curve25519_dalek.edwards.CompressedEdwardsY
+  point : curve25519_dalek.edwards.EdwardsPoint
+
+end ed25519_dalek

verification/gen/CurveSig/TypesExternal.lean

@@ -0,0 +1,35 @@
+/- ──────────────────────────────────────────────────────────────────────────────
+   gen/CurveSig/TypesExternal.lean — external types for the verify glue.
+
+   The three curve types (CompressedEdwardsY, EdwardsPoint, Scalar) are NOT
+   axiomatized: importing CurveField.Types makes every fully-qualified
+   reference in CurveSig/Funs.lean resolve to the PROVEN model's types —
+   the glue and the curve share one universe.
+
+   Only the genuinely foreign types stay opaque — THE deliberate boundary:
+   · sha2.Sha512            — the SHA-512 hasher state (hash opaque by design)
+   · ed25519.Signature      — the wire-format signature (only observed
+                              through the opaque `to_bytes`)
+   · signature.error.Error  — the RustCrypto error value (verify's spec only
+                              distinguishes ok from err)
+   ────────────────────────────────────────────────────────────────────────────── -/
+import Aeneas
+import CurveField.Types
+open Aeneas Aeneas.Std Result ControlFlow Error
+set_option linter.dupNamespace false
+set_option linter.hashCommand false
+set_option linter.unusedVariables false
+
+/-- [sha2::Sha512] — opaque: the SHA-512 hasher state. -/
+@[rust_type "sha2::Sha512"]
+axiom sha2.Sha512 : Type
+
+/-- [ed25519::Signature] — opaque: the 64-byte wire signature, observed only
+    through `to_bytes`. -/
+@[rust_type "ed25519::Signature"]
+axiom ed25519.Signature : Type
+
+/-- [signature::error::Error] — opaque: the error value carries no
+    information the verification spec depends on. -/
+@[rust_type "signature::error::Error"]
+axiom signature.error.Error : Type

verification/gen/CurveSig/TypesExternal_Template.lean

@@ -0,0 +1,57 @@
+-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS
+-- [ed25519_dalek]: external types.
+-- This is a template file: rename it to "TypesExternal.lean" and fill the holes.
+import Aeneas
+open Aeneas Aeneas.Std Result ControlFlow Error
+set_option linter.dupNamespace false
+set_option linter.hashCommand false
+set_option linter.unusedVariables false
+
+/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/
+set_option maxHeartbeats 1000000
+
+/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/
+set_option maxRecDepth 2048
+
+/-- [curve25519_dalek::edwards::CompressedEdwardsY]
+    Source: 'curve25519-dalek/src/edwards.rs', lines 175:0-175:29
+    Name pattern: [curve25519_dalek::edwards::CompressedEdwardsY]
+    Visibility: public -/
+@[rust_type "curve25519_dalek::edwards::CompressedEdwardsY"]
+axiom curve25519_dalek.edwards.CompressedEdwardsY : Type
+
+/-- [curve25519_dalek::edwards::EdwardsPoint]
+    Source: 'curve25519-dalek/src/edwards.rs', lines 390:0-390:23
+    Name pattern: [curve25519_dalek::edwards::EdwardsPoint]
+    Visibility: public -/
+@[rust_type "curve25519_dalek::edwards::EdwardsPoint"]
+axiom curve25519_dalek.edwards.EdwardsPoint : Type
+
+/-- [curve25519_dalek::scalar::Scalar]
+    Source: 'curve25519-dalek/src/scalar.rs', lines 193:0-193:17
+    Name pattern: [curve25519_dalek::scalar::Scalar]
+    Visibility: public -/
+@[rust_type "curve25519_dalek::scalar::Scalar"]
+axiom curve25519_dalek.scalar.Scalar : Type
+
+/-- [sha2::Sha512]
+    Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/digest-0.11.2/src/buffer_macros/fixed.rs', lines 12:8-15:9
+    Name pattern: [sha2::Sha512]
+    Visibility: public -/
+@[rust_type "sha2::Sha512"]
+axiom sha2.Sha512 : Type
+
+/-- [ed25519::Signature]
+    Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-3.0.0/src/lib.rs', lines 316:0-316:20
+    Name pattern: [ed25519::Signature]
+    Visibility: public -/
+@[rust_type "ed25519::Signature"]
+axiom ed25519.Signature : Type
+
+/-- [signature::error::Error]
+    Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/signature-3.0.0/src/error.rs', lines 25:0-25:16
+    Name pattern: [signature::error::Error]
+    Visibility: public -/
+@[rust_type "signature::error::Error"]
+axiom signature.error.Error : Type
+