mrwulf 1bc4f39f35 round 7: assert pin-map completeness (NEW-13), correct the count to 137, fix the regeneration-scope contradiction ... The third reviewer demonstrated NEW-13: PROVENANCE.json is a tracked file that nothing pins, and Phase 0's only completeness test was 'is the map non-empty'. Deleting the harness_integrity_sha256 key therefore silently un-pinned BOTH lean-guard and Proofs/Audit.lean with no diagnostic, after which the round-6 logic mutation ran to ALL GREEN over a repository proving False with the digest byte-identical. Reproduced here before fixing. The required pin NAMES now live hardcoded in check.sh — policy in the root of trust, values in the map — so a shortened map is a build failure naming the missing entries. Self-test attack 18 performs the deletion. GPT reviewer, independently: the documented '131 assertion points' was wrong. Recounted from the code, the defensible figure is 137 mono-path evaluated cases (9 retained original + 108 randomized + 10 NIST internal + 10 NIST external-pure); 131 had folded in 3 deployed-only prehash cases while omitting the retained test, and TRUSTED-BASE then decomposed it as 20 + 108 = 128, contradicting itself. Item 9 now carries the full table, states that 127 of the 137 compare mono against deployed, keeps the 3 prehash cases explicitly outside the total, and records that only two SHA2-512 and one SHAKE-256 vector are executable there — so this is not NIST coverage of all four supported prehash variants. Also from GPT: PROVENANCE.json contradicted itself, saying extraction 'reproduces all four model files byte-identically' while its own _comment correctly said the two *External files are hand-maintained. Extraction regenerates two files; the other two are byte-pinned. Corrected. TRUSTED-BASE item 11 now discloses that PROVENANCE.json is itself load-bearing and unpinned, and item 7's stale snapshot head is fixed. README states the lean-guard graceful fallback and that the empirical bridge runs on stable Rust without any Lean toolchain (round-7 NEW-16), which is the first load-bearing part of this work a third party can reproduce with cargo alone. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-28 13:03:35 +02:00
..
gen/SlhVerify	TypesExternal: correct a header that described a type the file no longer contains	2026-07-28 10:16:57 +02:00
Proofs	review round 5: bind the policy, the specification bodies, and the harness	2026-07-27 22:57:46 +02:00
AUDIT-MANIFEST.txt	review round 6: pin the auditor, purge every olean, pin gen/ as a set	2026-07-28 09:22:12 +02:00
check-selftest.sh	round 7: assert pin-map completeness (NEW-13), correct the count to 137, fix the regeneration-scope contradiction	2026-07-28 13:03:35 +02:00
check.sh	round 7: assert pin-map completeness (NEW-13), correct the count to 137, fix the regeneration-scope contradiction	2026-07-28 13:03:35 +02:00
drill.sh	drill: the post-flight drill becomes a button (drill.sh)	2026-07-23 15:36:00 +02:00
extract.sh	round 7: assert pin-map completeness (NEW-13), correct the count to 137, fix the regeneration-scope contradiction	2026-07-28 13:03:35 +02:00
lean-guard	lean-guard: surface clamp/kill diagnostics on stderr (operator incident 2026-07-24)	2026-07-24 21:37:05 +02:00
PROVENANCE.json	round 7: assert pin-map completeness (NEW-13), correct the count to 137, fix the regeneration-scope contradiction	2026-07-28 13:03:35 +02:00
RECORDED-RUN.md	round 7: assert pin-map completeness (NEW-13), correct the count to 137, fix the regeneration-scope contradiction	2026-07-28 13:03:35 +02:00