mrwulf d6e4d938de phase 2 WIP: chain (Alg 5) spec — fold defined, base case proven ... drafts/ChainSpec.lean (NOT in Proofs/, NOT in check.sh — carries a sorry, so nothing is claimed proven; H1/H2 hold): - chainFoldN: the mathematical s-fold of the opaque hash F, threading the hash-address (i, i+1, …, i+s-1) and index exactly as the extracted loop body does. Equational spec (chain_free_loop = chainFoldN) — chosen over a WP triple so it needs no assumption that the opaque oracle.f succeeds (both sides fail together if it does). - chain_free_loop_eq: induction on the step count via loop.eq_1. BASE CASE PROVEN (empty range start..start reduces to ok tmp, PartialOrdU32.lt start start = false). Step case is the one open front: align the loop's monadic forward_checked with the fold's start+1 (u32 add-spec from the no-overflow bound) and fold the loop continuation back for the IH — the dalek loop-spec pattern, tractable. De-plumbing (prior commit bde63f5) means this cone will carry only the kernel three + oracle.f once closed. First real certificate incoming. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-23 00:00:53 +02:00
..
drafts	phase 2 WIP: chain (Alg 5) spec — fold defined, base case proven	2026-07-23 00:00:53 +02:00
gen/SlhVerify	phase 2 step 1: de-plumb the u32 range-loop machinery	2026-07-22 23:54:03 +02:00
Proofs	SLH-DSA (FIPS 205) campaign skeleton: honest zero-certificate state	2026-07-22 21:00:57 +02:00
check.sh	Phase 1: clean extraction + type-checking SLH-DSA-SHA2-128s model	2026-07-22 22:21:19 +02:00
extract.sh	audit catch 2: the oracle boundary is FIVE, not six	2026-07-22 23:02:40 +02:00
lean-guard	SLH-DSA (FIPS 205) campaign skeleton: honest zero-certificate state	2026-07-22 21:00:57 +02:00