2 commits

Author	SHA1	Message	Date
mrwulf	b4e8a4e733	audit: bind the scalar statements, and make the accounting identity mean audit ... Closes four round-7/8 findings. Certified by the round-12 sweep: five repositories, both buttons and every self-test, 48/48 GREEN. ── `scalar-statements-unbound` (gpt, round 7, CRITICAL) ──────────────────── The main button bound its 31 certificates' elaborated statements and reachable specification bodies. This button bound NONE of its thirteen, while TRUSTED-BASE item 8 said the audit covers "every certificate" — false across the 44-certificate surface. The finding was raised in round 7, lost from the round-8 work list by an F-number collision between two reviewers, and re-raised in round 8. Proofs/ScalarAudit.lean is generated from each fork's OWN Audit.lean, so the canonicalisation is provably the same code: pp.all rendering, whitespace normalisation, transitive specification closure. check-scalar.sh Phase 3c pins the block's digest, requires the committed copy to match byte-for-byte so a mismatch can be DIFFED, and cross-checks the auditor's certificate set against the button's CERTS array. dalek ecf3a3f8 · anza 0d942e47 · risc0 4b550a61 · betrusted 4b550a61 risc0 and betrusted share a digest and that is correct, not a collision: their ScalarSubSpec.lean differs only in doc prose and in `black_box` entries inside `simp only [...]` lists AFTER `:= by`. Proof scripts. They bind the same statements over the same specifications, which is the documented scope. selftest-scalar-statements.sh ships the two attacks the reviewer asked for: ok gutted statement caught (cone unchanged) ok rewritten specification body caught (name and cone unchanged) The second rewrites a reachable reference body to `id (…)` — DEFINITIONALLY EQUAL, so the corpus compiles and every proof typechecks and the cone is byte-identical. Every earlier phase is blind to it. ── `drv-surface-no-cones` + `accounting-certifies-enumeration` (claude) ──── The round-7 accounting identity proved every kernel constant was ENUMERATED. The reviewer showed enumeration is not audit: their planted claim WAS enumerated, as DRV|LTLAccAudit.bait.smuggled|theorem with a real cone, and nothing examined it — rows had no cone, no allowlist covered them, the statement digest does not reach instruments, and Phase 2b gates DECLARED AXIOMS, a different question. "Progress of one step, not two." DRV rows now carry their axiom cone and are pinned in driver-allowlist.txt by inventory_gate.sh with a DRV tag — the same implementation that pins the corpus, in both directions, because a second copy of a coverage gate is a second thing to drift. The axiom policy is per-surface and enforced per surface: the corpus admits exactly the sanctioned boundary, the instruments admit none, and an instrument axiom fails EVEN WHEN ALLOWLISTED. Verified with the reviewer's own payload, both placements: before the walk -> UNCLASSIFIED: DRV|…|bait.smuggled|theorem|Classical.choice,Quot.sound,propext after the walk -> ACCOUNTING FAILED names it (kernel-side) ── `drv-naming-heuristic` (claude, round 7) ──────────────────────────────── Retired as load-bearing rather than patched. The rule admits a theorem whose name extends a constant declared alongside it, and "breaks in one line" — declare `def bait`, then `theorem bait.smuggled` walks through. It stays as a fast readable first check; membership in a committed allowlist is what now carries the weight, and a new row fails closed whatever it is called. ── what round 11 caught, which was mine ─────────────────────────────────── DRV rows first shipped WITHOUT their originating driver. dalek and anza run two drivers, each declaring its own `corpus`; keyed on name alone those two distinct declarations produced one byte-identical row, `sort -u` collapsed them, and the trailers summed to 37 against 36. The estate had already learned this on the corpus walk — INV rows carry their module because two modules both declare CurveFieldProofs.zero_spec — and I rebuilt the record without it. Rows now carry their driver, and the gate FAILS CLOSED ON DUPLICATE RECORDS naming the collision: two declarations sharing one entry means one is covered by the other's, which is exactly how a real declaration hides. The trailer now checks what the drivers EMITTED, not what survives de-duplication — conflating "the run was truncated" with "two rows were identical" is what let a record-format defect present itself as an arithmetic complaint. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-08-03 12:15:26 +02:00
mrwulf	55a688858c	verification: pin the whole declaration surface (P1-b) ... Phase 2b asks the kernel whether any AXIOM is declared under Proofs/. Phase 3 pins the cones of the named certificates. Between them sat every other declaration in the corpus — around three thousand of them — and a helper lemma quietly acquiring a hash oracle in its cone moved nothing either phase looked at. Phase 2c closes that. Ported from ltl-accumulator-verified, where a nine-attack self-test proved a source-regex enumerator evadable by attributed, private, indented and `instance` declarations and by a nested-namespace basename collision. Reading the compiled environment sees what the kernel saw; no name shape hides. Every constant contributes module, name, kind and full axiom cone, and the observed set must equal inventory-allowlist.txt exactly in BOTH directions, with a count trailer so a truncated run cannot pass as an empty diff. FOUR THINGS THIS BUILD GOT WRONG, each caught by a check rather than by review: - The number of inventory drivers is a per-repo FACT, not an assumption. dalek and anza cannot import their corpus as one environment (Proofs.Basic and Proofs.ConstSpecs both declare CurveFieldProofs.zero_spec); risc0 and betrusted have no Proofs.Basic at all. Determined by compiling a probe. check.sh now DISCOVERS its drivers from the filesystem instead of naming two, and the generator refuses to split out a module the repo lacks. - The split let one real declaration hide behind another's entry. Keyed on name alone, the two zero_specs produced byte-identical records, so 3022 declarations were covered by 3021 allowlist entries. Caught by the count trailer. Every record now carries its originating module. - The gate's success line said "single sanctioned axiom", inherited from the accumulator's policy. This corpus permits NONE. A success message describing a different rule is how an assertion stops meaning anything. - selftest-axgate.sh lifted Phase 2b with a range ending at "Phase 3", so inserting Phase 2c between them made it swallow the new phase and die on variables only check.sh defines — surfacing as the BASELINE case failing, a self-test blaming a gate for its own extraction bug. Both self-tests now stop at the next phase marker whatever it is called, and refuse to run if they capture more than one phase. The guard is the fix; the range was the symptom. WHAT THIS IS NOT, recorded in TRUSTED-BASE.md at the same length as the claim: - No independent cone walker. The accumulator cross-checks collectAxioms against a hand-written walker. Ported here it was wrong in BOTH directions on mathlib's inductive shapes: EdPoint gave [] against the kernel's three axioms, and once extended, ProjPoint gave three against the kernel's none. Two implementations disagreeing both ways are a second wrong answer, not a check. These cones rest on collectAxioms alone. - Thirteen Proofs/Scalar* modules are inventoried by nothing — the second-button seam, still open. Phase 2c names every uncovered module on every run so the omission is visible rather than inferred. selftest-inventory.sh exercises the shipping gate with six cases, each asserting a specific diagnostic, including the one that matters: a cone widened by one oracle while name, module and kind stay put. Negative-tested by disabling the gate's diff, which turns two cases red including one for the wrong reason, correctly reported as such. Verified green: 20 runs across the four repositories (four buttons, four harness, four inventory, four axgate, four binding self-tests), zero red. The four check-scalar.sh greens from the preceding sweep stand: that script neither reads the pin file nor changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-30 01:20:15 +02:00