fips205.base2b_outer_loop_eq (Proofs/InputPrepSpec.lean): the extracted
digit-writing outer loop (helpers.base_2b_loop0) equals the explicit fold that,
for each output index, runs the inner `while bits < b` accumulation loop
(base_2b_loop0_loop0, consumed as an OPAQUE sub-call — same treatment as
ht/fors give their sub-loops) then writes baseb[out] = (total >> bits) &
(u32::MAX >> (32-b)). Cone EXACTLY [propext, Classical.choice, Quot.sound] —
kernel-3, no oracle (pure bit/byte digit extraction).
This completes the input-prep layer's named milestone (to_int, to_byte,
base_2b) — all four prep certs kernel-3 clean. base_2b's inner while-loop
VALUE fidelity (a fuel-induction value-level statement) is deliberately NOT
claimed here; the outer loop pins the digit-writing structure with the inner
accumulation threaded opaquely, exactly as every other layer treats its
sub-loops.
Proof: the ForsOuterSpec straight-line-nesting-a-loop recipe. The step lemma
PEELS the inner-loop triple sub-call with `apply bind_congr; rintro
⟨inn1,bits1,total1⟩` then closes the small tail with full simp — a bare rfl
would whnf the nested `loop` term and blow the heartbeat budget (the drill-9
lesson, applied deliberately). Compiled first try.
check.sh: CERTS += fips205.base2b_outer_loop_eq. Green over ALL TEN
certificates at default caps.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three straight-line range-loop fidelity theorems (Proofs/InputPrepSpec.lean),
each #print axioms = EXACTLY [propext, Classical.choice, Quot.sound] — pure
byte/bit arithmetic, NO hash oracle enters (the cleanest cones in the campaign):
- fips205.to_int_loop_eq (Algorithm 2, toInt): the extracted big-endian
byte->u64 loop = the fold total <- (total<<8) + x[i].
- fips205.to_byte_loop_eq (Algorithm 3, toByte): the extracted u32->byte loop =
the fold writing s[n-1-i] and shifting total right by 8.
- fips205.wots_csum_loop_eq: the WOTS+ checksum loop = the fold
csum <- csum + (W-1-msg[i]).
All three are the straight-line recipe (hbody -> step lemma closed by rfl ->
induction with bind_congr per bind). to_int + checksum use the usize range
helpers (WotsSpec), to_byte the u32 range (ChainSpec); loop_unfold_bind reused.
Also in this commit — DE-PLUMBING ROUND 2 landed (source bea1051, separate
commit in fips205-source): to_int's iter().take() and base_2b's iter_mut()
became index loops, so both extract to real definitions. Consequently:
- gen/ regenerated (to_int_loop / base_2b_loop0 now clean StepUsize range
loops with Slice.index_usize / Slice.update; the six prior certificates
recompiled UNCHANGED and re-audited green against the new gen).
- The core::iter::adapters::take::Take::next AXIOM — the LAST non-oracle,
non-zeroize plumbing axiom on the verify path — is now unreferenced and was
DELETED from FunsExternal (dead-stub hygiene rule). The model's external
surface is now EXACTLY: the 5 SHA-2 oracles + 3 zeroize blanket impls (never
on the verify path) + the discharged-real u32 Step defs. Nothing else.
Fidelity review at authorship (three-way): extracted loop bodies (gen
Funs.lean) == Rust helpers.rs to_int/to_byte + verify_mono checksum (verbatim
FIPS 205 Alg 2/3) == the folds above.
check.sh: PROOFS += InputPrepSpec; CERTS += the 3 certs; audit imports it.
Green over ALL NINE certificates at default caps (400s/4096MB).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
