ltl-accumulator-verified/KNOWN-GAPS.md

# Known gaps and scope boundaries (honest ledger)

**Numbering note (2026-07-19):** "paper §N" references in this ledger
use the archived system report's numbering ("The Lean Transparency
Log", https://ltl.zkdefi.org/paper/v0.2), which this corpus was built
against. The current paper at /paper has a different structure; in
particular its §5.3/§5.4 are unrelated to the §5.3/§5.4 cited in gap
14/15 below.

Deliberate, documented, and none silent. Reviewers should verify this
list is COMPLETE, not merely that the items are acceptable.

1. **SHA-256 is opaque** — the single boundary axiom (`LTLAcc.sha256`),
   by design identical to the paper's posture: soundness theorems
   construct collisions, never assume collision resistance.
2. **No consistency-completeness theorem** (honest ConsRec acceptance).
   Matches the paper (its Theorem 1 is inclusion-only); honest
   consistency behavior is covered by the fidelity harness's honest
   cases (within the 230,016-case consistency agreement with the
   deployed verifier).
3. **Lemma 2 is mechanized as specializations, not as one general
   theorem.** The paper's Lemma 2 is a single statement quantified over
   an abstract hash-fold `F` and a connected subtree `S`. The corpus has
   no hash-fold datatype/predicate; it proves the needed instances
   directly — whole-tree (`extractMTH_correct`), ConsRec
   (`consRecBinding`), inclusion (`extractIncl_correct`), and the width
   fact (`hnode_preimage_inj`). These suffice for Theorems 2–3. Two
   consequences: (a) the abstract lemma itself is not a mechanized
   object; (b) the path-instance receipt-uniqueness for `Root` (removed
   with the vacuous `root_binding`) is not restored — optional, unused.
   Any paper claim that "Lemma 2 is mechanized" must read "its
   specializations sufficient for Theorems 2–3 are mechanized." 
4. **Signature layer abstract** — Ed25519 EUF-CMA, the poison/evidence
   retention state, and transferability of fork evidence (paper Prop
   1(2)) are not modeled; `fork_distinct` is the Merkle-layer share only.
5. **Transliteration bridge** — `fidelity/lean_defs.py` mirrors the Lean
   definitions by quoted-source inspection (the Lean defs are
   noncomputable over the opaque hash, so the bridge cannot be #eval'd
   closed). Same inspection bridge the paper's own harness uses.
6. **Proposition 2 (verdict integrity) out of scope** — per paper §10's
   mechanization list (i–v). It is a property of the consumer tooling's
   construction, enforced and regression-tested in the pacta repo.
7. **Multi-step pin monotonicity** — mechanized per-step
   (`pinAccept_monotone`); the paper's multi-step chain is its
   reflexive-transitive iterate, not separately mechanized.
8. **Process history** (candor): three cone pins were guessed (not read)
   during S5.3–S6 and the audit's failure went unnoticed until S7
   because green was claimed from tailed output rather than the exit
   code. No theorem was affected (kernel-checked throughout); pins were
   corrected, the audit surface defined, and the standing rule is now:
   exit code + ALL GREEN, cones read from #print axioms only.

9. **Asymptotic cost not mechanized.** Paper Theorems 2 and 3 assert the
   extractors run in `O(n)` / `O(n₁)` hash evaluations. The mechanization
   proves functional correctness of the named extractors only — no cost
   semantics, recurrence, or computability-after-hash-instantiation. (The
   extractors are `noncomputable` over the opaque `sha256`.)
10. **Pin-store initialization from the empty pin not modeled**, and
   `pin_prefix_correct` assumes `0 < n`. Trust-on-first-use / the size-0
   initial state is a separate operation; the theorems cover transitions
   from a positive-size pin. (Related to gap 7's per-step scoping.)
11. **acceptIncl now named (was review F1).** The consumer's inclusion
   acceptance `m < n ∧ Root … = some r` is now the Lean object
   `acceptIncl`, with `acceptIncl_complete`/`acceptIncl_sound` routing
   completeness/soundness through it, and the fidelity harness exercises
   the out-of-range families (`m ≥ n`). `Root` alone still accepts
   out-of-range `m`; that is by design (it is the reconstruction, not the
   accept predicate).
12. **Audit-gate lineage** (candor; was round-2 GPT H1 / Claude NEW-1,
   both round-1 "fail-closed" claims were overclaims). The round-2
   coverage gate enumerated declarations with a source regex and was
   evadable (attributes, indentation, private/protected, `instance`,
   nested-namespace basename collisions). Round 3 replaced it with an
   environment-derived inventory (`Proofs/Inventory.lean` +
   `inventory-allowlist.txt`, fully-qualified names, no filtering) and
   `selftest_audit.sh`, which runs the published evasion table plus a
   namespace collision, an axiom smuggle, a stale-entry case, and two
   unmanifested-module cases against the exact production gate.
   Residual honesty: the inventory sees what the compiled environment
   contains; it cannot see source that is never compiled (which the
   dead-file checks cover) or defeat a hostile Lean toolchain.
13. **Review-kit fidelity target was not self-contained in round 2**
   (GPT H2: missing load-time imports made `run_fidelity.py` unrunnable
   from the kit). Round 3 ships the complete stdlib-only import closure
   of `pacta.transparency`, content-addressed against pacta commit
   `3d81d53`, plus the clean-extraction transcript with exit code.
14. **Deployed `verify_consistency` accepted lied-size proofs the
   mechanized `ConsRec` rejects** — finite pinned family, no global
   inclusion relation claimed. **[CLOSED 2026-07-23 — see closure note
   at the end of this item.]** (round-3 Claude addendum F1*, reproduced
   by the operator against deployed pacta). Witness:
   for the honest proof P between sizes 2→3, `verify_consistency(1, 3,
   R2, R3, P)` returns True — a semantically false claim ("R2 is the
   root of a size-1 prefix") — while `ConsRec` rejects; 3,405 such
   divergences exist for n < 60, ALL one-sided (the mechanized model
   never accepts anything the deployed verifier rejects; inclusion
   shows zero divergences under identical abuse). Mechanism: when the
   claimed old size is a power of two, the deployed iterative verifier
   (an RFC 9162-style loop, but see root cause) seeds the walk with the
   old root and uses the sizes only
   as bit-navigation state, so several size claims navigate one proof
   identically. (Root cause, identified at closure: the deployed
   verifier omitted RFC 9162 §2.1.4.2 Step 7's terminal `sn == 0`
   condition; see the closure note below.) Consequences: (a) fidelity
   between the two consistency
   verifiers is agreement over the pinned case families, NOT
   extensional equality — the harness's lied-size family pins the
   boundary (73,573 cases: lied old size exhaustive for n < 60, lied
   new size at fixed offsets n−1/n+1/n+7; 3,867 expected divergences,
   direction asserted one-sided per case); (b) Theorem 3 /
   `acceptCons_sound` cover the MECHANIZED accept set. The exhibited
   divergence is outside the intended pin-store input invariant;
   applying the mechanized soundness result to the deployed flow
   therefore additionally ASSUMES that the deployed state machine
   always binds each root to its authentic size and exposes no
   alternate invocation path — an invariant that is NOT mechanized in
   this corpus (gap 15). Where the invariant's witnesses live: paper
   §5.3 (the signed head binds `(n₁, r₁)` together under one
   signature) and §5.4 (the pin `(n₀, r₀)` comes from the consumer's
   own store, never from the peer), implemented in the pacta repo at
   `src/pacta/sthstore.py` and `src/pacta/logclient.py` — code OUTSIDE
   the supplied fidelity target (review R4-3/GPT-4). No exploitability
   against that flow is claimed or ruled out here; assessing it
   requires the signature/STH layer (gap 4).

   **CLOSURE (2026-07-23, pacta `ddbb5a4`).** The earlier sentence
   "deployed behavior matches upstream RFC 9162 implementations" was
   incorrect: the deployed `verify_consistency` implemented the RFC
   9162 §2.1.4.2 bit-navigation loop but omitted its Step 7 terminal
   condition that the new-size navigation counter reach zero
   (`sn == 0`). That omission — not any property of RFC 9162 — is the
   whole of the divergence: a faithful RFC verifier rejects the same
   lied-size family. Restoring the one conjunct removes every divergence
   in the pinned 73,573-case family, verified by a new three-way
   regression `test_consistency_lied_size_three_way_agreement`
   (deployed verifier / recursive `ConsRec` model / an independent
   faithful RFC 9162 transliteration) over both the honest and lied-size
   families. The divergence was originally surfaced by this corpus's own
   two-way fidelity harness; the missing third (RFC) oracle is what
   assigned blame to the deployed side rather than the model. The
   historical divergence remains truthfully recorded in public log entry
   13 and is reproducible at the tagged pre-fix commit
   `vulnerable/sn0-consistency-fd2f6ba`; public entry 13, the attested
   accumulator commit `172a1d0`, and the IACR submission PDF are all
   unchanged. Gap 15 (deployment refinement invariant) remains open.
15. **Deployment refinement invariant unmechanized** (round-4 GPT, its
   principal finding — split out from gap 14 because it carries the
   deployed-soundness claim). The corpus proves soundness of the
   mechanized `acceptCons`; it does NOT prove the refinement
   `AuthenticPair(n₀,r₀,D₀) ∧ AuthenticPair(n₁,r₁,D₁) ∧
   verify_consistency(…) → acceptCons(…)`. The operational invariant
   (authentic-size/root binding via the signed-head + pin-store flow)
   is relied upon but unverified, and the consumer flow implementing it
   is not in the supplied fidelity target. Consequently any attestation
   of this corpus must be scoped to the MECHANIZED model: "the deployed
   consistency verifier is formally verified" is NOT a claim this
   corpus supports. Closure paths (roadmap, operator decision, post
   paper-freeze): (A) make the deployed verifier adopt
   ConsRec-equivalent acceptance; or (B) mechanize the signed-head +
   pin-store state machine and prove the refinement; or (C) keep the
   boundary and this scoped claim permanently.
16. **The statement binding covers identity, not meaning** (added
   2026-07-28 with `check.sh` Phase 3d). The coverage gate pins every
   constant's name, kind and axiom cone, both directions; Phase 3d
   additionally pins every constant's fully-elaborated TYPE and every
   definition's fully-elaborated BODY, digest committed as
   `AUDIT-MANIFEST.txt`. What that buys is that the corpus is the one
   that was reviewed. What it does NOT buy: (a) whether those
   statements say anything worth believing is a question a human
   reading `STATEMENT-MAP.md` answers, not the button; (b) an author
   who edits a definition and refreshes the digest in the same commit
   passes every phase — the defence is that both changes are visible in
   the diff at the pinned commit; (c) proof TERMS are deliberately not
   bound, by proof irrelevance, so a proof rewritten to a different term
   of the same statement and cone moves nothing.
   Worth recording plainly, because it was measured rather than
   reasoned: wrapping one branch of `pinAccept`'s body in `id (…)` is
   definitionally equal, compiles, leaves name/kind/type/cone untouched,
   and the coverage gate reports GREEN. Only the digest sees it. That is
   the exact size of the gap Phase 3d closes, and
   `selftest_statements.sh` case 1 replays it.