(sqrt_ratio_i_sq_spec, kernel-audited)
The largest single proof of the decompress chain: for square u/v
(witness x, v nonzero), the extracted sqrt_ratio_i returns choice 1 and
the even-parity root - Bnd r (2^52), r^2 * v = u, r's canonical residue
even. The walk composes every previously certified piece: the
square/mul/pow_p58 candidate chain, sqrt_m1_spec, fe_ct_eq_spec x3 (the
three constant-time residue checks), neg_spec, the Choice bitor, and
fe_cond_assign_spec twice (root flip by sqrt(-1), then sign
normalization via is_negative).
Case analysis: sqrt_core's disjunction (v*r^2 = +/-u) against the check
flags - u = 0 collapses everything to the zero root; u != 0 with
v*r^2 = u kills both flip flags (u = -u forces u = 0 in odd
characteristic; u = -u*i forces u*(1+i) = 0 with 1+i nonzero); with
v*r^2 = -u the flip fires and (i*r)^2 * v = -(-u) = u. Parity: the odd-
prime negation flip (ZMod.neg_val), zero-root edge included. New
helpers: eq_neg_self_iff_zero, one_add_i_ne_zero.
Certificate exact standard three; full button green fresh. Remaining:
from_bytes walk, decompress_of_canonical, replication, pass 4.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(kernel-audited)
- fe_cond_assign_spec: the per-limb constant-time selection on field
elements (real extracted code: five index_mut rounds over the u64
select) keeps self iff the choice is 0 - the operation sqrt_ratio_i
uses for both the root flip and the sign normalization. Walked with
backfun-rewrite hygiene; the u64 model lemma restated locally
(Proofs.Basic is a parallel root that clashes with ConstSpecs).
- sqrt_core: THE ALGEBRAIC HEART - for square u/v (witness x, v nonzero)
the candidate r = (u*v^3)*(u*v^7)^((p-5)/8) satisfies v*r^2 = +/-u.
The v-part of the exponent collapses by Fermat (8*(2^253-5) = 2(p-1));
the residual x^((p-1)/2) is +/-1 by factoring its square. Exponent
bookkeeping: (p-5)/8 = 2^252-3, (p-1)/2 = 2^254-10, all closed by
norm_num after pow_mul merges.
Both certificates exact standard three. Full button green fresh.
Remaining: the sqrt_ratio_i walk composing these, from_bytes,
decompress_of_canonical.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Proofs/DecompressSpec.lean, the arithmetic ingredients of sqrt_ratio_i:
- pow_p58_spec: a^((p-5)/8) = a^(2^252 - 3) via the pow22501 chain (the
invert_spec pattern).
- fe_ct_eq_spec: the constant-time field comparison DECIDES denotational
equality - because to_bytes is canonical (to_bytes_spec), byte equality
is residue equality in both directions. Supporting bridge lemmas:
bytesVal_inj (little-endian digits are unique, so value equality forces
list equality), bytesVal_congr, bytes_eq_iff_denote.
- sqrt(-1) needs no new work: ConstSpecs.sqrt_m1_spec (the constants
campaign) already pins SQRT_M1 to Bnd + denote*denote = -1.
Both new certificates exact standard three; full button green fresh.
Remaining in the chain: the sqrt_ratio_i success-case walk, from_bytes,
decompress_of_canonical.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
