mirror of
https://github.com/saymrwulf/dalek-ed25519-verified.git
synced 2026-09-04 20:24:12 +00:00
saymrwulf
1766544daf
sub_val_spec closes the top-level two-clause value spec: denote(Scalar52.sub a b) = denote(a) - denote(b) in ZMod l for limb-bounded inputs with canonical subtrahend (scVal b < l). Axiom-clean [propext, Classical.choice, Quot.sound]; no sorry. The assembly documented-as-remaining last session is now done. Key resolutions: - Applied the WP "spec_bind" rule manually instead of "step", and reduced the resulting "let (difference,borrow) := (dw,w)" Prod-let with an explicit "show" — this was the destructuring friction that blocked the earlier attempt (step's arity heuristics mis-typed the pair result). - Inlined the subtle "Choice::from" identity (no step-spec, like csel_step). - PERFORMANCE: kept "scLimbs" as opaque atoms in the gamma5=1 derivation instead of "unfold ... at *" — the unfold exploded omega with 2^52..2^260 coefficients and blew past 600s; atomic form proves in ~1 min (METHOD 4, same kernel-cost discipline as the field layer). - The 2^260 borrow-wrap and the +l conditional-add cancel in ZMod l: beta5=0 direct; beta5=1 forces top carry gamma5=1 from scVal b < l, closed by linear_combination over the two telescopes (sub_telescope, add_telescope). check-scalar.sh: sub_val_spec in the manifest + Phase-3 audit (4/4 clean); proof-phase caps raised to 600s/8192MB for the assembly; full button green. exponentiation.threshold raised to 300 for the 2^260 literal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| gen | ||
| Proofs | ||
| check-scalar.sh | ||
| check.sh | ||
| CurveField.llbc | ||
| CurveScalar.llbc | ||
| extract-scalar.sh | ||
| extract.sh | ||
| lean-guard | ||