The corpus is now leaf index 12 of the log it describes. Status
FROZEN→ATTESTED; the 'attestation is a separate operator decision' line
is now the completed fact, with the live head, leaf hash, prefix
relation, and scope (KNOWN-GAPS 14/15) stated. Six review rounds noted.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The log now carries kernel-checked proofs of its own machinery. Subject
ltl-accumulator-verified@172a1d0, 61/61 proven+clean, mechanized-model
scope (KNOWN-GAPS 14/15). Consistency 12→13 accepted by both the
deployed verifier and the mechanized model; live-consumer-verified.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The drill caught: committing the paper outline advanced the pacta
working tree 8b1a325→84e0eb8, so the release tuple's exact-SHA
PACTA_COMMIT=8b1a325 was already stale and B1b's 'HEAD==PACTA_COMMIT'
would have falsely aborted. Verified 8b1a325..84e0eb8 touches ONLY
paper/ (zero producer code). Fixed the invariant to pin the producer
CODE (PACTA_CODE_BASE=8b1a325, git diff -- src provider must be empty),
tolerating doc-only commits above it — the correct thing to pin is the
reviewed producer code, not an ephemeral HEAD.
Drill also re-confirmed by execution (not from Opus-session logs):
operational append base pristine (12 entries, root bcd15f9d, max index
11, mtimes Jul 7 — uncontaminated by any rehearsal); B1 clean-room exit
0 + ATTESTATION GREEN with fidelity; live log 12/bcd15f9d; producer
suite 115/115.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Execution found: the append signs with the verified-dalek-serial
dogfood backend, which needs BOTH the built binary (dogfood/state/) and
the key (provider/state/local-provider/) — neither exists in a fresh
clone (a fresh clone fails the wallet dogfood-signer test, orthogonal
to the log path). B1b now verifies the operator's working tree is at
PACTA_COMMIT, tracked-clean, binary present, suite green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two defects found in the first minutes of Phase B, both in my own check
text, both would have misfired on a PRISTINE log:
- B0 'exactly 12 entries under entries/' counted 16 (the live log has
12 numbered leaves + 4 per-component <name>.attestation.json
convenience pointers). Now counts entries/[0-9]*.json and trusts the
STH tree_size.
- B3 'exactly 4 changed paths, receipts unchanged' was WRONG: publish
regenerates every component's inclusion-proof receipt against the new
head (correct CT behavior). Empirically captured on a throwaway
publish over the real published clone: 9 changed paths (3 new + STH +
history + 4 recomputed receipts); numbered leaves 0..11 and existing
attestation pointers byte-identical; provider.ed25519.pub unchanged
under the real key. The old check would have falsely aborted a
correct append.
Neither is a log problem — the log is pristine (12 leaves, bcd15f9d).
The rehearsal missed both because it checked only numbered-leaf
immutability; live-state execution caught them, as B0 is designed to.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Self-audit of the round-6 fix batch (operator-ordered drill) found and
fixed in this file:
- §2a pinned the producer at 87ef2a1 — but the GREEN 12→13 rehearsal
ran at d937a94, and 87ef2a1 LACKS the leaf-scope fix. The stale-pin
defect class (round-6's own critical) reintroduced within hours;
now names all three required pacta commits and the rehearsal commit.
- B0/A4 carried a FALSE mechanism claim: 'published leaf projections do
not rebuild the tree'. Executed check: they DO (hash each stored leaf
as-is; per-entry hashes match; root == bcd15f9d). The real trap is
double-wrapping on re-append. Both texts corrected — a wrong reason
in a runbook breeds future misdiagnoses.
- B2 called the candidate 'UNSIGNED' — check signs at generation; the
gate is inspect-before-APPEND. Reworded (+ B6 digest field renamed).
- Facts header said 'round-4 freeze'; key row said 'no second copy
exists' (contradicting A3b done); kit row stopped at round 4;
Phase-A heading still waited for IACR. All updated.
- B3c renamed B3b (there was no B3a/B3b sequence).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both round-6 reviewers' critical/high procedural findings:
- CRITICAL (both): runbook pinned the wrong commit (2da0a79 in the
facts table, B1 checkout, A4) while the reviewed subject and the
scoped-wording config live in 172a1d0. Re-pinned everywhere;
remaining 2da0a79 mentions are explicitly historical. Added §2a
release tuple (SUBJECT_COMMIT/PACTA_COMMIT/EXPECTED_OLD_SIZE/
EXPECTED_OLD_ROOT/KEY_FINGERPRINT) that every Phase-B step consumes.
- A2: "14 entries" → 15, with the dynamic grep count and gap 15 called
out as the claim-constraining one.
- GPT §10: new B0 — preflight the LIVE predecessor (size/root/STH-sig/
witness-audit-under-real-key/live-service/mirror agreement/no partial
entry 13/operational-state roots to bcd15f9d). An append-only system
re-reads its predecessor; it does not trust a Facts table.
- GPT §4: new B1b — clone + checkout + clean-tree + green-suite the
pinned PACTA_COMMIT; that is the only producer used.
- GPT §5 + both: new B2b candidate-leaf inspection gate (subject commit,
61/61 proven+clean, scope.deployment_constraints carries the required
wording and not the forbidden phrase, scope.exclusions complete) —
inspect before you append a leaf you cannot take back.
- GPT §11: exact changed-path set + prefix immutability (entries
0..11 byte-identical, one appended history line) instead of
"exactly four paths" by description.
- GPT §7/§8: B6 binds sanitized evidence (subject/producer commits,
config + candidate + fidelity-transcript digests, old/new roots,
consistency + witness + pin results) so the leaf's fidelity clause
points at a concrete object.
A4 redone as a structural 12→13 rehearsal (GPT Method B) — green:
predecessor copy roots to bcd15f9d, candidate 61/61 with scoped wording
IN THE LEAF, append→13, prefix immutability, consistency 12→13 accepted
by deployed AND mechanized model. Transcript on SD. Facts table:
pacta freeze lifted; producer = round-6 PACTA_COMMIT, not 3d81d53.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-4 verdicts: Claude reviewer — nothing blocks the freeze, no
remaining findings; GPT-5.6 — approve after minor documentation fixes,
attestation scoped to the mechanized model. This round is those fixes;
no Lean surface changed.
- 218/59 → 222/61 everywhere, and STRUCTURALLY: check.sh Phase 3c
asserts the audit counts (STATEMENT-MAP + README vs allowlist/CONES)
and the four fidelity pins (STATEMENT-MAP vs run_fidelity.py
constants) on every run — stale-count drift is a red button now
(R4-1, third recurrence of the class).
- Gap 14 reworded to evidence-vs-inference (the invariant "is assumed",
not "transfers"), witnesses cited (paper §5.3/§5.4; pacta
sthstore.py/logclient.py — outside the fidelity target). New gap 15:
deployment refinement invariant unmechanized (GPT's principal
finding, split out because it carries the deployed-soundness claim).
- Runbook: A1 marked done (both approvals on SD); B2 gains the REQUIRED
scoped attestation wording (GPT §11) as a gate condition — entry 13
cannot claim "deployed verifier formally verified".
- run_bare.sh fail-closes on Lean version AND commit (rejection path
tested with a fake toolchain: FATAL, exit 1).
- Harness: "consistency baseline family" line (GPT §8); gap 14 says
"fixed offsets n−1/n+1/n+7" (R4-5).
- RESPONSE round 5, incl. refutation of GPT §7 (the target tarball
demonstrably contains MANIFEST.sha256 + TARGET-PROVENANCE.md; the
round-5 kit also ships both unpacked as a courtesy).
check.sh exit 0 ATTESTATION GREEN (Phases 0-4 incl. new 3c); selftest
exit 0, 9/9 + control. Live LTL untouched (12 leaves, bcd15f9d…).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Parked blog-post source, publishes after entry 13 (so it can end with
a live leaf link). Part I: the tree holds verification-event records
(operator claims that name their own evidence via commit+toolchain
pins), not the Lean proofs; three-layer guarantee table (kernel /
replay pin / accumulator). Part II: the optimistic-rollup resemblance
made precise — two fraud layers (log-layer: Theorem 3 as a
constructive fraud-proof generator; claim-layer: replay with an
infinite challenge window), the honest enforcement gap (reputational
vs economic slashing, CT lineage), the watcher/liveness assumption,
and the inversion (validity-proven payload in an optimistic envelope;
entry 13 = formally verified fraud-proof machinery).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The append driver was never lost: pacta's committed provider/ CLI
(check / log-append / log-publish) produced leaves 8-11, signing heads
with the verified-dalek-serial dogfood backend (self_inclusion:
verified). Only the per-run orchestration was session work — A4 is now
rehearsal + private documentation, not reconstruction. A3: private key
located laptop-side (0600, gitignored state dir; public half
byte-matches provider.ed25519.pub); exact path deliberately excluded
from this public file. A3b: the key has NO second copy anywhere —
encrypted SD backup procedure added as a Phase-A blocker.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The droplet serves a DERIVED log dir rebuilt from a published/ mirror
(PersonalCloudServer DEPLOY.md § 'The LTL service') — B4 now refreshes
published/ and runs reconstruct.py instead of a bare app pull. Facts:
signing key verified NOT on the droplet (server only serves); server
deployment now version-controlled in private PersonalCloudServer@a186bac
(md5-verified == droplet).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Corrected the facts table (mirror URL scheme zkdefi.org/saymrwulf/,
nightly reconcile path + log) and replaced the server-side A5 with an
anonymous seven-repo GitHub==Forgejo head comparison.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Single authoritative ToDo between now and leaf index 12. Phase A (now):
reviewer confirmations, author statement read, operator-only key
confirmation (openssl pubkey diff against provider.ed25519.pub),
reconstruction of the never-persisted append driver (found 2026-07-12:
the leaves 8-11 driver was session work), Forgejo mirror verification.
Phase B (gated on ePrint decision + fresh explicit operator order):
clean-room button run, driver append, witness-audit, consumer
sth-refresh 12->13, publish, live checks, mirrors, SD archive. Iron
rules, failure protocol, and an Agent Appendix (key handling forbidden
to agents; the fifth gate condition cannot be satisfied from files).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-3 verdicts: GPT-5.6 conditionally approves (blockers closed, one
portability finding); the Claude reviewer's Socratic addendum produced
F1*, the strongest finding of the series — deployed verify_consistency
and mechanized ConsRec are NOT extensionally equal. Reproduced exactly
(witness verify_consistency(1,3,R2,R3,P(2→3))=True vs ConsRec reject;
3,405 divergences n<60; strictly one-sided; power-of-two seeding
mechanism confirmed in source).
- KNOWN-GAPS gap 14: witness, mechanism, one-sidedness, and the
pinned-pair side condition under which Theorem 3 transfers to the
deployed verifier (pacta's pin-store flow supplies it by
construction). No pacta code change; deployed behavior matches
upstream RFC 9162 implementations.
- fidelity: lied-size family — 73,573 boundary cases, 3,867 expected
divergences PINNED, one-sided direction asserted per case. Banner
rescoped: agreement over pinned families, not extensional equality.
- Theorem3.lean: acceptCons_sound (F2) — soundness over the named
acceptCons predicate, n₀=0 discharged from the non-prefix premise,
size bound derived from acceptance via new consRec_some_le. Cones
read from #print axioms; CONES/AxiomCheck/allowlist updated
(218 → 222 constants, diff = the two theorems + two generated
auxiliaries).
- F3/GPT§7: verification/lean-toolchain pin + run_bare.sh (reviewer's
standalone runner, plain public lean — verified green: 61 cones, 222
constants, gate green) + AENEAS_ENV override in check.sh and
selftest_audit.sh.
- F4: awk field-equality replaces regex-with-dots in Phase 3b.
- F5: git-tracked .pyc removed (worse than reported — it was in the
repo, not just the kit); __pycache__ gitignored; round-4 kit ships a
corpus MANIFEST.sha256 + pinned commit (also GPT's governance
condition).
check.sh exit 0, ATTESTATION GREEN; selftest exit 0, 9/9 + control.
Live LTL untouched (12 leaves, bcd15f9d…); attestation still gated on
ePrint decision + author review + explicit operator order.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-2 external reviews (GPT-5.6 + second Claude) converged on the
coverage gate being evadable (H1/NEW-1); GPT additionally proved the
kit's fidelity target could not run (H2) and the namespace-collision
attack that defeats any source-regex fix. This round adopts GPT's
required correction in full:
- Proofs/Inventory.lean: declaration inventory read from the compiled
Lean environment — every constant of every corpus module, fully
qualified, unfiltered (compiler auxiliaries and _private mangles
pinned too), with kind and axiom cone; own cone walker cross-checked
in-process against core collectAxioms (hard error on divergence).
- verification/inventory-allowlist.txt: all 218 constants pinned.
- inventory_gate.sh: fail-closed diff both directions (UNCLASSIFIED /
STALE), INV-COUNT truncation guard, exactly-one-axiom invariant.
- check.sh Phase 3b rewritten around the gate + manifest⇔inventory
drift checks + CONES⇔inventory cone cross-check (two independent
computations must agree). EXCLUDE table gone (sha256/Bytes are
ordinary audited entries now).
- selftest_audit.sh: 9 adversarial cases against the production gate
(attributed/indented/private/instance, namespace collision, smuggled
axiom, deleted decl, unmanifested Proofs/ and gen/ modules) + positive
control — all defeated (GPT release condition 2).
- M1: recursive orphan-olean guard (caught a stray dev artifact on its
first run), gen/ dead-file check, corpus-wide single-axiom pin.
- L1/NEW-2: acceptIncl_sound drops the redundant hm (derived from
hacc.1); cone unchanged.
- M2/M3: STATEMENT-MAP counts 230,271/230,016; non-vacuity guard
wording narrowed to what the guards actually certify.
- README layer table: stale L4/pin-store rows fixed (missed by both
round-2 reviewers AND the round-2 revision — found in self-review).
- KNOWN-GAPS 12 (audit-gate lineage + residual limits), 13 (round-2 kit
target not self-contained); gap 2 count fixed.
- RESPONSE-TO-REVIEWERS.md: round-3 disposition of every finding.
Kit round 3 additionally ships the complete stdlib-only import closure
of pacta.transparency (content-addressed vs pacta 3d81d53), the
clean-extraction fidelity transcript (exit 0, 230,271+230,016, zero
mismatches), the ATTESTATION GREEN check.sh transcript, and the
self-test transcript.
The live LTL remains untouched (12 leaves, root bcd15f9d…);
attestation stays blocked pending ePrint decision + author review +
explicit operator order.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
No theorem was wrong; every fix is spec-surface, audit-mechanism, docs,
or harness coverage. Changes:
LEAN (Claude F1, GPT M4):
- acceptIncl: the consumer's inclusion accept (m<n ∧ Root=some r) is now
a named object, not just a theorem hypothesis. Root alone accepts
out-of-range m; acceptIncl pins the guard.
- acceptIncl_complete / acceptIncl_sound: route Thm 1/2 through it.
- extractCons_correct_paper: Thm 3 at the paper's exact quantifiers
(n₀≤n₁, no separate 0<n₀; n₀=0 discharged since D₀=[]=take 0).
SCRIPT (GPT H1/H2, Claude F3):
- Phase 3b: fail-closed audit-surface COVERAGE — every named decl under
Proofs/ and gen/ must be in CONES or a documented EXCLUDE (sha256,
Bytes); anonymous gen instances count-pinned; every CONES key must be
queried by AxiomCheck (no pin-but-never-check). Tested: an
unclassified theorem now makes the button exit 1.
- H2: distinct markers — LEAN GREEN always, ATTESTATION GREEN only when
fidelity actually ran; SKIP/absent-pacta no longer emit the strong
marker. Attestation gate keys on ATTESTATION GREEN.
- Phase 0: orphan-olean guard (every Proofs/*.olean needs a sibling
.lean); deleted 6 orphans; untracked all *.olean/.lake from git and
gitignored them (root cause of the F3 tarball leak).
HARNESS (Claude F1, GPT M3):
- added out-of-range families (m≥n, m>n, n₀>n₁, n₀=0); re-pinned counts
230,271 / 230,016 (match the reviewer's independent RFC difftest
exactly); narrowed 'exhaustive' wording to the tested domain.
DOCS: README stale rows fixed (freeze banner no longer contradicts
table); KNOWN-GAPS gap 3 reworded (general Lemma 2 = specializations),
+gaps 9 (cost), 10 (pin init), 11 (acceptIncl resolved); STATEMENT-MAP
+acceptIncl rows, +Lemma-2-general note, +constant-vs-property
clarification for §10(i).
Button: EXIT 0, coverage complete, ATTESTATION GREEN, 230,271/230,016.
56 pinned cones over an ENFORCED surface. LTL untouched (12, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- STATEMENT-MAP.md: the review surface — every paper §6/§10 item mapped
to its Lean name, file, and cone; the named-extractor design invariant
and the anti-pigeonhole guards explained; the audit surface stated.
- KNOWN-GAPS.md: eight honest scope boundaries, including the process-
history candor item (the guessed-pins/false-green episode and its fix).
- README: frozen banner. Final sweeps: button EXIT 0 + ALL GREEN +
FIDELITY GREEN; zero sorry; the only ∃-conclusions are content-bearing
(kbelow_pow2) or hypothesis-guarded helpers — no collision
existentials anywhere.
Corpus: 54 pinned cones over a defined surface, single sha256 boundary,
Lemma 1 axiom-free, Theorems 1-3 + Prop 1(1) + whole-tree Lemma 2 +
fidelity 164,479/164,224. Frozen at this commit pending external review.
LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Audit-of-the-coverage-audit. Its 18 added cone values re-verified against
the observed #print outputs (all match). Methodology blind spots found:
abbrev Bytes (bare alias, no cone content — excluded by nature) and the
two ANONYMOUS gen/ instances, which are silently load-bearing
(DecidableEq Hash powers ConsRec's 'if C = []' and pinAccept's root
compare; Inhabited Hash powers every getD default). Transitivity covered
them, but no hand-waves before external review: cones read and pinned —
instInhabitedHash = [propext], instDecidableEqHash = AXIOM-FREE. The
audit-surface definition is now documented in check.sh itself.
Button verified by exit code: EXIT 0, ALL GREEN, FIDELITY GREEN.
54 pinned cones. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Re-derived S7 as Fable, practicing the standing rule (check exit code +
ALL GREEN, not tail). Confirmed committed button genuinely exits 0.
FINDING: the cone audit had a COVERAGE gap — 34 of 52 proven objects
were pinned; 18 (incl. core defs kbelow/hleaf/hnode and the pin-store
defs pinAccept/pinExtract/acceptCons, plus intermediate lemmas) were
never cone-audited. Transitively safe (Phase 1 forbids axiom under
Proofs/, Phase 2 forbids sorry, universally) — but 'transitively
covered' is not good enough for an externally-reviewed corpus. Closed:
every proven theorem/def now has its EXACT cone pinned, read from
#print axioms (not guessed). Coverage now 52/52, empty unaudited list.
Cones of note: hleaf/hnode = [LTLAcc.sha256] only; kbelow and the pure
arithmetic/list helpers = no hash axiom; the def-level objects that
touch MTH carry the single sha256 boundary. No surprise axioms anywhere.
Button verified: EXIT 0, ALL GREEN, FIDELITY GREEN, 164,479/164,224
pinned. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
FIDELITY (the deliverable): fidelity/lean_defs.py transliterates the Lean
MTH/Path/Root/ConsRec (post-refactor decidable-if base) to Python;
fidelity/run_fidelity.py differential-tests them vs the DEPLOYED pacta
verifiers over test_paper_verifiers.py's exact case generation. Result:
MTH==merkle_root (256), Path==inclusion_proof (32,896), verifier
agreement over 164,479 inclusion + 164,224 consistency cases (incl.
honest consistency). Pinned counts match the paper. Wired as check.sh
Phase 4 (gated on pacta presence, SKIP_FIDELITY to skip).
HONEST CORRECTION: three cone pins added in S5.3-S6 were WRONG
(take_all and consRec_base_true_eq are [propext]; consRec_base_false_eq
is [propext, Classical.choice, Quot.sound]) — I had guessed
[propext, Quot.sound]. check.sh's Phase 3 audit was therefore EXITING 1
since S5.3, but I reported 'green' from tailing cert lines instead of
checking the exit code / ALL GREEN. Pins now corrected to the observed
cones; the button now genuinely exits 0 with ALL GREEN + FIDELITY GREEN.
No THEOREM was ever wrong (kernel-checked); the failure was the audit
harness rejecting mis-pinned cones — working as designed, caught late by
my process gap. Process fixed: verify exit code + ALL GREEN, never tail.
35 certs green (verified by exit 0). LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The consumer pin store (§5.4) as a transition predicate; the paper's
Prop 1(1) fully mechanized:
- pinAccept: same-size ⇒ root match; smaller ⇒ reject (rollback); larger
⇒ consistency proof verifies. Mirrors sthstore.py.
- pinAccept_monotone: an accepted step never shrinks the pin (definitional).
- pin_prefix_correct: an honest advance where D is NOT the prefix of D'
makes pinExtract output a genuine collision — same-size routes to
extractMTH (whole-tree Lemma 2), grow routes to extractCons (Theorem 3).
Explicit named-extractor form ⇒ non-vacuous (pin_prefix_nonvacuous
pinned).
- fork_distinct: the Merkle share of Prop 1(2) — different roots at equal
size commit to different content. EUF-CMA transferable-evidence is
signature-layer, OUT OF SCOPE and documented in the file header (not
smuggled).
Cones: single hash axiom (pin_prefix_correct adds Classical.choice via
functional induction downstream). 33 certs green. Fable statement-audit:
matches paper Prop 1(1); Prop 1(2) scope-bounded honestly. LTL untouched.
Every §6 statement is now kernel-checked: Lemma 1, Theorems 1-3,
whole-tree Lemma 2, Proposition 1. Remaining: S7 fidelity, S8 freeze.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The previous drill's equivalence theorems were only as strong as their
RHS matching the ACTUAL historical base (not a from-memory
reconstruction) and 'nothing else changed' being true. Both now verified
against the repository itself: git show cfde9b2 confirms the RHS forms
verbatim; git diff cfde9b2..8795e82 confirms the refactor is base-only
(eight lines). Provenance recorded in Refactor.lean's header so the
argument is self-contained: unchanged remainder (git) + equal base
(kernel) => whole-function equality. 26 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Re-derived S5.3 (all done under an Opus switch) from zero. consRecBinding
STATEMENT re-confirmed faithful to paper Thm 3 steps 1-2 (y=MTH D₁ = the
hash-fold condition; some=>collision / none=>x=MTH(D₁.take n₀) = the two
Lemma-2 outcomes); non-vacuous (some-branch is a SPECIFIC-pair IsCollision,
not pigeonhole-provable; none-branch a real equality needing hcons).
FINDING + FIX: Opus changed ConsRec's base definition (list-match →
decidable if) with only 'recompiled clean' as evidence — a definition
that mirrors the deployed verifier. Now machine-checked: consRec_base_
false_eq / consRec_base_true_eq prove the decidable-if base EQUALS the
exact list-match forms it replaced. Kept as PERMANENT cone-audited
theorems (F1 discipline: keep the evidence), not a throwaway probe.
QUEUED for S5.4: extractCons_correct (Theorem 3 endpoint) MUST carry a
permanent non-vacuity witness like extractIncl_nonvacuous/extractMTH_
nonvacuous. S7 must re-confirm the NEW ConsRec base vs Python.
26 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The single hardest proof in the corpus is complete, no sorry. Under the
value-equality invariant y = MTH D₁, an accepting ConsRec fold either
makes extractConsNode output a genuine collision or its first component
is the honest prefix root MTH(D₁.take n₀).
- ConsRec base changed from list-match to decidable if (if C=[] /
if C.length=1) — same root-cause fix as Root, avoids WF-unfold
exhaustiveness obligations; more faithful to the deployed Python.
Whole chain (Basic..Consistency) rebuilt clean.
- consRecBinding by ConsRec.induct (10 cases): 4 base/singleton, 3
rejection/none contradictions, 2 recursive (n₀≤k, n₀>k). The n₀>k
none-branch is where all S5.1 infrastructure interlocks:
kbelow_prefix_eq (prefix splits at same k) + take_take_le +
take_drop_prefix assemble x = hnode s xx into MTH(D₁.take n₀). The
collision branches use append_inj (fixed-width Hash) + MTH_split.
- take_all helper (take-whole-list).
Cone [propext, Classical.choice, LTLAcc.sha256, Quot.sound] — single hash
axiom. 24 certs green. Fable statement-audit: matches paper Thm 3
steps 1-2. LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Re-derived the planned stage-3 binding against the extractConsNode
definition. Definition is SOUND (candidate/ConsRec hnode alignment
re-confirmed: n₀≤k hnode y s ↔ 0x01::y'++s; n₀>k hnode s y ↔ 0x01::s++y').
FINDING (protects stage 3): extractConsNode's candidate is a
genuine collision ONLY under y_current = MTH(D₁_current) — sha256(LHS) =
hnode y' s = y_current, sha256(RHS) = MTH D₁_current, equal iff the
value-equality invariant holds. The stage-3 binding statement MUST thread
through the recursion (Lemma 2's top-down equality). Planned
statement already carries it; note now flags it as load-bearing so it
can't be dropped.
LEDGER: cfde9b2 claimed the extractor 'verified faithful' — that
overclaimed kernel-verification; it is inspection-only until
consRecBinding is proven. README corrected to say so.
No Lean change (definition sound). 22 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The consistency collision extractor: walks the ConsRec new-root fold in
parallel with the honest size-n tree of D₁ and returns the concrete
colliding node preimage pair at the first level where the fold's hnode
argument pair diverges from the honest node — or none if the fold is
genuine all the way down (binding holds). Both branches verified faithful
to ConsRec's hnode argument order (n₀≤k: y' left / s right; n₀>k: s left
/ y' right). Termination via kbelow bounds.
Deliberate honest checkpoint: the DEFINITION compiles and is cone-audited
[propext, LTLAcc.sha256, Quot.sound]; the binding CORRECTNESS proof — the
single hardest object in the corpus — is stage 3, kept for a fresh
session rather than a rushed long turn. 22 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Theorem 3's binding (steps 1-2) turns on one non-obvious arithmetic fact,
isolated and proven here before the main proof:
- pow2_exp_unique / kbelow_eq_of_pow2_between: kbelow is pinned by its
three defining inequalities (power-of-two, k<n≤2k), so a prefix that
spills past the left subtree splits at the SAME point.
- kbelow_prefix_eq: with k=kbelow n, 2≤n, k<n₀≤n ⇒ kbelow n₀ = k (the
fact the n₀>k recursion branch needs to align MTH(D₁.take n₀) with the
fold).
- take_take_le, take_drop_prefix: the list-surgery identities relating
(D.take n₀) to D.take k and (D.drop k).take (n₀-k).
Cones pinned; 21 certs green. Deliberate honest checkpoint — binding +
extractCons assembly is the next stage. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adversarial re-derivation of S4. The mathematics HOLDS: extractMTH_correct
is faithful to paper Theorem 3 step 3 (hypotheses, recursion, node/leaf
collision cases all re-verified), sub-call length/difference obligations
sound, non-vacuity witness valid.
The defect was in the CLAIM: S4's commit/README stated extractMTH
'restores the receipt-uniqueness content of Lemma 2'. Wrong instance.
Lemma 2 has three instantiations; the deleted root_binding was the PATH
instance (uniqueness of accepting receipts (v,P) for Root, quantifying
over adversarial paths); extractMTH is the WHOLE-TREE instance (MTH
injective on equal-length leaf lists). Nothing in the corpus currently
states path-uniqueness. Ledger corrected: whole-tree instance done;
path instance honestly listed as deleted-and-not-restored (optional —
not needed for Theorem 3 assembly).
No Lean changes; 18 certs remain green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The 'descend' step of the paper's Theorem 3, built extractor-first per
the S3.5 lesson (never a bare '∨ collision'):
- extractMTH (D D'): total function that, given two equal-length leaf
lists sharing a Merkle root, walks the common-shape tree to the first
divergence and returns the concrete colliding preimage pair (a node
pair, or a leaf pair at the bottom).
- extractMTH_correct: |D|=|D'| ∧ D≠D' ∧ MTH D = MTH D' →
IsCollision (extractMTH D D'). Proven by functional induction on
extractMTH; composite case uses MTH_split + append_inj (fixed-width
Hash) to split node preimages or exhibit the node collision.
- extractMTH_nonvacuous: equal lists → output NOT a collision (pinned),
so the conclusion is false for some inputs ⇒ choice-proof.
This also RESTORES, in explicit non-vacuous form, the receipt-uniqueness
content of Lemma 2 deleted in the S3.5 cleanup (re-audit F2): the honest
Merkle fold is injective up to a collision.
18 certs green. Fable statement-audit passed (matches paper Thm 3 step 3
verbatim). LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adversarial re-derivation of S3.5 (drill after harness switch). Core
verdict CONFIRMED: extractIncl_correct is faithful and non-vacuous.
Three methodical flaws found and resolved:
- F1: the non-vacuity proof existed only as a deleted probe — evidence
discarded. Now permanent: extractIncl_nonvacuous proves the
extractor's output on a NON-forgery input is NOT a collision, so the
correctness conclusion is false for some inputs and cannot be
discharged by pigeonhole/choice. Guards against future drift back
into vacuity. Cone pinned.
- F2 (queued for S4): deleting root_binding discarded the receipt-
uniqueness content of Lemma 2 (left disjunct: P = Path m D) along
with its vacuous disjunct. To be restored in extractor form during
S4; the S4 consistency walk inlines the same argument regardless.
- F3: README still claimed 'root_binding done' — a deleted theorem
advertised as delivered. Ledger corrected.
15 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The S3 Socratic re-audit found incl_sound was kernel-perfect but VACUOUS:
its '... ∨ HasCollision' disjunct (∃ x y, x≠y ∧ sha256 x = sha256 y) is
provable by pigeonhole ALONE (sha256: infinite List UInt8 → finite
32-byte Hash), so the theorem said nothing about forgeries. Even a
data-carrying {p // IsCollision p} disjunct fails (Classical.choice
inhabits it). The only faithful rendering of the paper's 'explicit
algorithm 𝓔' is a NAMED FUNCTION whose correctness is a claim about ITS
OUTPUT.
- extractIncl (m D d P): total function that walks the honest tree and
returns the concrete colliding preimage pair at the first divergence
(a node preimage pair, or the leaf preimage pair at the bottom).
- extractIncl_correct: d ≠ D[m] ∧ accepting-receipt →
IsCollision (extractIncl …).1 (extractIncl …).2. A statement ABOUT the
fixed function's output; pigeonhole cannot discharge it.
ADVERSARIAL CHECK (probe, since removed): proved
¬ IsCollision (extractIncl 0 [[7]] [7] []) — i.e. on a NON-forgery input
the output is provably NOT a collision, so the conclusion is genuinely
false for some inputs ⇒ non-vacuous, choice-proof.
- Removed the vacuous theorems entirely (incl_sound, root_binding,
hnode/hleaf_inj_or_collision, HasCollision def) so no hollow statement
survives in a corpus destined for the log. Kept the real building
blocks (hnode_preimage_inj [propext]; eq_dropLast helper moved to
Completeness; Binding.lean deleted).
extractIncl_correct cone [propext, Classical.choice, LTLAcc.sha256,
Quot.sound]. THE button green (14 certs). Fable statement-audit passed.
LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The crux layer — the statement whose HAND proof once carried the frontier
coverage bug is now kernel-checked.
- gen: hash outputs refactored to Hash = {l : List UInt8 // l.length = 32}.
MECHANIZATION FINDING: the paper's pair-coincidence step ('equal hnode
values of distinct argument pairs are a collision') is load-bearing on
FIXED-WIDTH outputs — with unconstrained byte strings x++s = X++Y does
not split. hnode_preimage_inj (cone: propext) makes this explicit via
List.append_inj on equal-length components. Queued as a half-sentence
for the paper's next cycle.
- HasCollision := ∃ x y, x ≠ y ∧ sha256 x = sha256 y — appears ONLY as a
conclusion, never a hypothesis (no collision-resistance assumed).
- hnode_inj_or_collision / hleaf_inj_or_collision: the per-node dichotomy.
- root_binding: any accepting reconstruction from (v,P) to the honest root
either IS the honest receipt (leaf hash AND full path P = Path m D — case
(ii) pinning every consumed sibling) or exhibits a collision. Motive
quantifies (v,P); induction on Path; k-fold discipline.
- incl_sound (Theorem 2, position binding): accepting a wrong leaf at m
yields a collision. Cone [propext, Classical.choice, LTLAcc.sha256,
Quot.sound] — the single hash axiom, pinned in check.sh. ALL GREEN.
Also: Root n=1 branch changed from list-match to decidable 'if P = []'
(well-founded unfolding generated a spurious exhaustiveness obligation);
Root_one_cons added. Fable-5 statement-audit passed. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adversarial statement-level re-verification of everything S2 shipped,
against paper SS5.3 and the deployed Python verifier: Path recursion,
Root_left/Root_right fold shapes (none exactly where the deployed code
rejects), incl_complete as Theorem 1 verbatim (getD default unreachable
under m < |D|), MTH([]) = H(epsilon) per RFC. All faithful.
One genuine gap found and closed: the kbelow lemmas bounded k but never
established k is a power of two, leaving 'our split point = the RFC
split point' as by-construction folklore. kbelow_pow2 (cone: propext,
Quot.sound) now pins it: 2^j = k < n <= 2k = 2^(j+1) uniquely
determines the RFC 9162 split. THE button green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Path (prover-side inclusion path, paper SS5.3) with termination via the
kbelow bounds; self-contained list lemmas (getD_take, getD_drop - no
stdlib-name dependence); equation lemmas MTH_single/MTH_split/Root_one/
Root_left/Root_right (Option.map form; matcher side conditions closed
explicitly); Theorem 1 by functional induction on Path with a k-fold
discipline against the let-bound split point.
incl_complete cone: [propext, Classical.choice, LTLAcc.sha256,
Quot.sound] - pinned exactly in check.sh alongside Path.
THE button green end to end. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Accumulator pyramid layers 1-2, mechanizing paper SS5.3/SS6 groundwork:
- gen/LTLAcc/HashExternal.lean: the single sanctioned axiom, opaque
sha256 (no properties assumed - the soundness theorems downstream are
constructive collision extractors).
- Proofs/Basic.lean: hleaf/hnode (0x00/0x01 domain stamps); Lemma 1
(domsep) proven AXIOM-FREE; kbelow (largest power of two below n)
with pos/lt/le-two bound lemmas; MTH, Root (Option = rejection),
ConsRec (four cases, b-flag, pinned anchor) - all with kernel-checked
termination via the kbelow bounds.
- check.sh: estate discipline (stub audit, axiom-smuggling gate,
lean-guard compilation, boundary-exact per-certificate cone audit).
All green; observed cones pinned exactly.
Zero contact with the live LTL: no appends, no server, accumulator
frozen at 12 leaves throughout this project.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
