mirror of
https://github.com/saymrwulf/fips205-slhdsa-verified.git
synced 2026-09-03 19:53:49 +00:00
mrwulf
f2f262ae90
Ported from the ed25519 forks and the accumulator, where it exists because a
round-7 reviewer DEMONSTRATED the gap rather than argued it.
Phase 3's audit runs inside Lean and reads `env.constants` after the imports —
an ELABORATION-TIME view. Anything declared AFTER the command that performs the
walk is in the compiled object file but not in the environment while the walk
runs. The walker then reports "no axiom, no claim" and is telling the truth
about what it could see.
This phase reads the OBJECT FILES via `readModuleData`: a different view of the
same modules, with no such ordering. Deliberately a second, independently
implemented gate on the property that matters most — that nothing in the proof
corpus DECLARES AN AXIOM, whatever its indentation, attributes or position.
DEMONSTRATED, not asserted. An `axiom cheat : ∀ (P : Prop), P` appended to
Proofs/Audit.lean after its audit command:
=== Phase 3: in-Lean audit … <- PASSED, saw nothing
=== Phase 3b: kernel-side axiom gate <- AXIOM DECLARED under Proofs/
Audit.olean: cheat
exit 1
The environment walk passed it and the kernel gate caught it, which is the
whole argument for having both.
PLACEMENT IS LOAD-BEARING. Written first as Phase 2b — the forks' position — it
died with COVERAGE, because Phase 2 compiles the eight certificate modules and
Proofs/Audit.lean is only compiled by Phase 3. That failure was correct: a gate
that skipped a missing module would be vacuous exactly where it matters, since
the audit driver is the one module whose own declarations no other gate
examines. Covering it requires waiting for it, so the gate runs after Phase 3.
Fails closed three ways: a manifest module whose artifact is absent, an axiom in
any module, and a scan that read zero declarations (an empty result and a clean
result must not share a code path). Membership from this script's PROOFS array
plus the driver, never a glob.
Result: 298 declarations across 9 compiled modules, none an axiom.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| gen/SlhVerify | ||
| Proofs | ||
| AUDIT-MANIFEST.txt | ||
| check-selftest.sh | ||
| check.sh | ||
| drill.sh | ||
| extract.sh | ||
| lean-guard | ||
| model-correspondence.py | ||
| MODEL-CORRESPONDENCE.txt | ||
| PROVENANCE.json | ||
| RECORDED-RUN.md | ||