The window under audit claimed the campaign's first certificate, so this
drill was maximally adversarial. Everything of substance HELD:
- three-way model fidelity EXACT: extracted chain_free_loop.body ==
chainFoldN step == the Rust origin, operation-for-operation including
address threading
- button green fresh; axiom sweep over ALL 8 declarations minimal
(pure lemmas = kernel-3; oracle-touching = kernel-3 + oracle.f only)
- non-vacuity PROVEN: the concrete 1-step consequence (one address-set +
one hash call) derives from the certificate by rfl
- commit body of cfd50bb intact (the one flagged fragment was a bad
drill grep pattern, not an artifact); worktree clean; heads synced
NEW, from the drill (R3-5 tradition): verification/check-selftest.sh -
permanent adversarial self-test of the check.sh gates. Attack 1 (dead
Proofs file) and attack 2 (certificate with a smuggled axiom) must both
make check.sh fail; both verified rejected, selftest green, self-cleaning.
An audit that cannot fail is theater; this one demonstrably can.
Two notes for the record: (a) bind_congr is the generic Bind-class
congruence from core/Mathlib, not Aeneas.Std.Primitives (memory
corrected); (b) the certificate covers chain_free_loop - the thin
chain_free wrapper (bound computation + massert + clone) gets its
trivial composition lemma in the wots layer, where it is consumed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
