mrwulf 0fa36c7258 phase 2: THIRD CERTIFICATE — XMSS auth-path Merkle loop (Algorithm 10) ... fips205.xmss_loop_eq (Proofs/XmssSpec.lean): the extracted xmss_pk_from_sig_free_loop equals the explicit Merkle-path fold — at step k set the tree height to k+1, test bit k of the leaf index; even bit: tree_index := i/2 and H(node || auth[k]); odd bit: tree_index := (i-1)/2 and H(auth[k] || node). This pins the sibling hash ORDER, the address schedule, and the auth-path indexing of Merkle verification. Exact cone: [propext, Classical.choice, Quot.sound, verify_mono.oracle.h] — the first certificate where H enters; F does not (the loop runs above the WOTS+ computation). check.sh green over all three certificates. Fidelity review at authorship (three-way): extracted body (gen Funs.lean 761-801) == Rust verify_mono.rs xmss_pk_from_sig_free (verbatim from upstream xmss.rs, hash calls -> oracle) == FIPS 205 Algorithm 10, incl. the per-branch operation order (even: node-slice then auth[k]; odd: auth[k] then node-slice) and the k+1 tree height. Proof: the chain/wots recipe on a u32 range — u32_succ / fwd_succ / hnext / loop_unfold_bind reused VERBATIM from ChainSpec. New layer lesson (the one novel obstruction, on pattern): the loop body BRANCHES on the index bit, so the step lemma splits with by_cases + if_pos/if_neg; and the get_tree_index pair-bind needs its matcher made concrete before the tail normalizes — bind_congr + rintro to fix the scrutinee, then FULL simp (only full simp iota-reduces the pair matcher; simp only will not) with bind_assoc + bind_ok + the loop def closes each branch. The certificate's own induction threads the IH under the opaque binds of BOTH branches with bind_congr, per branch, ending exact ih. check.sh: PROOFS += XmssSpec, CERTS += fips205.xmss_loop_eq, audit imports XmssSpec (self-test structure anchors untouched). README: status three certificates, Algorithm numbering per upstream comments (wots=8, xmss=10). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-23 16:18:44 +02:00
..
.gitkeep	SLH-DSA (FIPS 205) campaign skeleton: honest zero-certificate state	2026-07-22 21:00:57 +02:00
ChainSpec.lean	phase 2: FIRST CERTIFICATE — chain (Algorithm 5) proven, button green	2026-07-23 11:34:59 +02:00
WotsSpec.lean	phase 2: SECOND CERTIFICATE — WOTS+ chain loop (Algorithm 8) proven	2026-07-23 14:48:39 +02:00
XmssSpec.lean	phase 2: THIRD CERTIFICATE — XMSS auth-path Merkle loop (Algorithm 10)	2026-07-23 16:18:44 +02:00