mirror of
https://github.com/saymrwulf/dalek-ed25519-verified.git
synced 2026-09-03 20:13:48 +00:00
mrwulf
74d1497e96
Round-8 review (GPT-5.6, register key `section-prefix-bug`, CRITICAL).
Reproduced here exactly before fixing.
model-correspondence.py treated `namespace`, `section` and `end` as one event
class and pushed a named section onto the fully-qualified-name prefix. Lean
does not: `section Foo` opens a scope for `variable`/`open` and gives `end Foo`
a label; it does not turn `bar` into `Foo.bar`. Given a template reading
section Foo
axiom bar : Nat
end Foo
the scanner reported `Foo.bar`, `--names` handed Phase 2d only `Foo.bar`, Lean
resolved an unrelated `Foo.bar` definition elsewhere in the corpus, and the
verdict came back PROVEN. The axiom the extraction ACTUALLY depends on was
never queried. This survived both the fail-closed rewrite and the new
Lean-semantic phase, in a scanner rewritten that same week specifically to
stop dropping things.
AND THE REASON IT STAYED SILENT, which is the half worth keeping. The real
external did not vanish — it landed in the table as EXTRA, the one verdict
that could not fail. A silent bucket beside a fail-closed parser is a slower
way of dropping things. An extra AXIOM is now EXTRA-AXIOM and stops the
button: the model exists to answer the template, so an assumption nothing
asks for is either a parse we got wrong or an assumption nobody governs.
Extra definitions stay tolerated; helpers in a model file are ordinary.
That gate fired on the real corpora on its first run. Each fork's
hand-maintained gen/CurveField/FunsExternal.lean carried AVX2/AVX512 backend
axioms present in no template, no proof, no cone and no allowlist — dead
assumptions in a pinned trusted-base file, reported as EXTRA and therefore
invisible. extract.sh:16 confirms these files are never overwritten by
extraction, so they were hand-written and are removed here:
dalek 2, anza 3, risc0 4, betrusted 4
Nothing referenced them, so no certificate's cone changes; the trusted base
simply gets smaller. Table rows 64->62, 51->48, 57->53, 56->52, and Phase 2d
independently resolved 62/48/53/52 externals against the regenerated tables.
GEN-MODEL.sha256 and HARNESS.sha256 both move: the model bytes changed, and
the harness pins the table and the gen manifest themselves.
Certified: round-10 sweep, 2h53m, ten instruments in each of four forks,
40/40 GREEN, 0 failing, 0 resource-limited. A full run was required — the
--audit-only staleness gate correctly refused after a source change.
Registered in formal-verification-control/review-findings.tsv as
`section-prefix-bug` and `dead-model-axioms`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
12 lines
1.1 KiB
Text
12 lines
1.1 KiB
Text
b6f95ccf7c47d94b8de4996ffb73f5e64f3915e981d77bb61c75d22b4b2dd947 CurveField/FunsExternal.lean
|
|
f23af27f3148e8ac6181d077e558d30e73936fc54a1cb3928d70687c1d37c644 CurveField/FunsExternal_Template.lean
|
|
0b7b818978e3a0274d547d1bcf25634be98c55d813950dc4a541bd7adef60b21 CurveField/Funs.lean
|
|
d197d7b9fe515863784eeee59a2fbb69735d10ebcf5cc4e03feb3afbeb53a2b7 CurveField/TypesExternal.lean
|
|
4560fc87c6156df16c34117db0817dc0926709f884728d9ca907985cbf931c6c CurveField/TypesExternal_Template.lean
|
|
b4bbcff308d2626b37c2cda0c17afb97d95b19fd158fe4842af942f0bbb5b6ad CurveField/Types.lean
|
|
621111b9d6b946ddc73ed13fbc14a861f6df94ba85eab8338cb5b7e823a2cd72 CurveSig/FunsExternal.lean
|
|
ee04a32c9f5a5032622ae0d20c6a764eba36a016af21a8ebc1db3740d35d0ccc CurveSig/FunsExternal_Template.lean
|
|
64fadb72dfce4e64a988b544c4a2182b5240fe95057815e31da93d54bb676ac3 CurveSig/Funs.lean
|
|
4e2468f2ab255d3e9065d5ad179b412cffd1d7251e716cbe704c36916267c069 CurveSig/TypesExternal.lean
|
|
16df7ed5eadb054bf78c4abb537adbc03c17f504babfca69a0e0bb7fb81314f0 CurveSig/TypesExternal_Template.lean
|
|
e6dcaaa1a5d832ea54f4eecff55aa4dabc653f55b3a56cddaaed5feabe671fb9 CurveSig/Types.lean
|