P0-a was applied to the four ed25519 repositories on 2026-07-30 and never
here. Found by the control repo's capability matrix, which asks the property
rather than looking for a phase by name.
The finding that made it matter there applies verbatim: a verification that
never cleans up cannot distinguish "these proofs check" from "these proofs
check GIVEN WHATEVER IS LYING AROUND". Compiled artifacts are gitignored, so
no `git status` can show a reader that a verdict rested on an object from an
earlier run of a different script.
This repository has no --audit-only mode, so the purge is unconditional.
Button green (80s) and the 14-case self-test green after the change.
CLASS 15 — a Lean file where no phase was looking. The dead-file scan read
Proofs/*.lean and gen/LTLAcc/*.lean and nothing else. A module at the
verification root, or under any other gen/ subdirectory, was neither
compiled nor rejected — while remaining importable by name, since LEAN_PATH
contains both roots. That is a source of the corpus that no phase reads and
no pin covers, which is exactly what the dead-file gate exists to forbid; it
was simply looking in two places instead of everywhere. Now nothing may live
in either root but the two enumerated sets.
CLASS 9 — the instruments' own declaration surface. AxiomCheck.lean and
Inventory.lean perform the audit and are therefore not corpus, so nothing
inventoried what THEY declare. Inventory.lean now walks both: AxiomCheck by
module index, and itself as the module still being elaborated, whose
declarations are the ones the environment reports with no originating
module. That is what makes the inventory cover the instrument that produces
it rather than exempting itself.
The policy is not "declare nothing" — this file legitimately declares its
machinery. It is that an instrument may declare only inert definitions. An
axiom here would widen the trusted base without appearing in any
certificate's cone; a theorem here would be a claim no certificate covers
and no allowlist pins. A flat ban on theorems was WRONG and was measured to
be wrong: defining a function by well-founded recursion makes the elaborator
emit its own obligations, and axiomCone._proof_1 rejected this very file.
The distinction that holds is whether a theorem is a claim someone wrote or
an artefact of a definition declared alongside it — an artefact's name
extends the name of a constant declared with it.
Observed surface: 18 declarations, 16 def and 2 generated obligations, no
axiom, no standalone claim.
The drivers are byte-pinned already, so this does not pin WHICH definitions
they contain — that would add a thing to maintain without adding a thing to
catch. It adds the property byte-pinning cannot give: that no instrument
declares an axiom or a claim, whatever its bytes are.
selftest_audit.sh: 10 cases -> 14. Case 12 uses an INDENTED axiom, because
Phase 1's source grep catches an unindented one and the point is to reach
the kernel-side walk standing behind it.
TWO DEFECTS IN THE TEST HARNESS, found while adding the cases.
· The scratch tree copied verification/ only, but the button also reads
README.md and STATEMENT-MAP.md from the repository root. check.sh
therefore ALWAYS died in Phase 3c in the scratch tree, which made every
`if check.sh; then <attack not caught>` guard unfirable — check.sh could
not pass in there even with no attack at all. Only the diagnostic greps
were doing any work. The documents are now copied, and the negative test
below proves the guard is live: with the driver-surface check disabled,
check.sh PASSES a tree whose inventory driver declares
`axiom driver_cheat : False`.
· Case 9 was the last case when it was written and left its rogue gen file
in place. Harmless then; the new cases inherited it. Cleaned up between
the blocks rather than inside case 9, so that case still tests what it did.
Also fixed while here: Phase 3b compared the compile manifest against
Inventory.lean by grepping the WHOLE FILE for a backticked module name, so
prose counted — a doc comment naming a module broke the count, and in the
other direction a doc mention of a module missing from the array would have
satisfied the presence check and hidden the omission. It now reads the
arrays.
Both new gates negative-tested by removal. Button green, self-test green.
This repository has the estate's strongest gates, which makes them the most
valuable to switch off. Until now every one of them was executed by scripts
that nothing pinned.
Phase 0c requires every harness file to match HARNESS.sha256 — 15 files:
check.sh, lean-guard, inventory_gate.sh, run_bare.sh, all three self-tests,
both audit drivers (Proofs/Inventory.lean, Proofs/AxiomCheck.lean), the policy
tables (inventory-allowlist.txt, AUDIT-MANIFEST.txt), the toolchain pin, the
fidelity harness and its Python transcription, and the extracted model.
WHICH files must be pinned is policy and lives in check.sh, never in the map
being consulted: the required set is derived from the filesystem (the
executable bit, plus gen/**.lean, plus an explicit list for the rest), so
deleting a pin entry is a set mismatch rather than a silent un-pinning.
gen/LTLAcc/HashExternal.lean was previously bound by nothing at all — it was
compiled and trusted. It is now pinned, and the derivation is by set, so a new
model file fails closed.
selftest_audit.sh case 9 is split rather than relabelled. Phase 0c now catches
an unpinned rogue gen module BEFORE the dead-file gate runs, so asserting only
the new diagnostic would have quietly retired the dead-file gate from the test
suite. 9a asserts the harness-set mismatch on the unpinned file; 9b pins it —
an author who added it deliberately — and asserts Phase 2 still dies with DEAD
FILE (gen). Ten cases now, all defeated.
KNOWN-GAPS and the trusted base record the circularity plainly: an author who
edits a script and refreshes its pin in one commit passes every phase. The pin
removes the silent path, not the possibility. Review at the pinned commit
remains the consumer's protection.
Verified green after the fix: button (75s), harness self-test, binding
self-test, and the ten-case audit self-test. ATTESTATION GREEN (Lean +
fidelity), all fidelity case counts identical to the pre-change run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
STATEMENT BINDING (Phase 3d). The coverage gate pins every constant's name,
kind and axiom cone, both directions, and none of selftest_audit.sh's nine
attacks defeat it. It is nevertheless blind to what a declaration SAYS — and
that is demonstrated here rather than argued:
Wrapping one branch of `LTLAcc.pinAccept`'s body in `id (…)` is
definitionally equal. Every downstream proof still compiles. The name, the
kind, the type and the axiom cone are unchanged. The inventory gate reports
"222 constants, environment == allowlist" — GREEN.
That edit is harmless by construction; the point is that nothing stood between
it and a genuinely vacuous redefinition of a specification. Proofs/Inventory.lean
now also emits, for every inventoried constant, its fully-elaborated TYPE, and
for every definition its fully-elaborated BODY — 266 lines over 222 constants.
Proof terms are deliberately absent: by proof irrelevance a theorem's content
is its statement. check.sh Phase 3d binds the SHA-256 and the block is
committed as AUDIT-MANIFEST.txt so a mismatch is DIFFED, not merely reported.
The existing gate is untouched, per the standing rule that the port flows FROM
this repo, not to it: INV lines are byte-identical, inventory_gate.sh is
unchanged, and all nine of its attacks still fail as before.
selftest_statements.sh replays the defeq edit as case 1, asserting BOTH that
the coverage gate passes it and that Phase 3d catches it — so if the coverage
gate ever grows to see this, the test says so instead of quietly re-labelling.
Cases 2-4 cover a hand-edited committed block, a truncated block, and a
constant inventoried without a statement.
FIDELITY PIN (unrelated, found while running the button). Phase 4 had been
failing since 2026-07-23: LIED_PIN_DIV expected 3,867 divergences between the
Lean model and the deployed consistency verifier, and observed 0. Cause is
pacta ddbb5a4, which restored the RFC 9162 2.1.4.2 Step-7 terminal `sn == 0`
condition; that one conjunct removes every divergence in the pinned
73,573-case family. KNOWN-GAPS gap 14 already recorded the closure on the day
it landed — only this constant was stale, so the button had been red for five
days with nobody running it. The pin now reads 0 with the history in a comment.
Nothing about the paper, public log entry 13, or the attested commit 172a1d0
changes; the historical divergence stays reproducible at the tagged pre-fix
commit.
KNOWN-GAPS gap 16 records what the binding does not buy: identity, not
meaning; an author who edits and re-pins in one commit is caught by review and
not by the script; and proof terms are unbound by design.
Button green end to end: ATTESTATION GREEN (Lean + fidelity).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The deployed verify_consistency was corrected (pacta ddbb5a4) to restore
RFC 9162 2.1.4.2 Step 7's terminal sn==0 check. Gap 14 is marked CLOSED
with a closure note, and two incorrect statements in the original item
are fixed:
- "accepts strictly more than the mechanized ConsRec" -> the finite
pinned-family one-sidedness (no global inclusion relation claimed).
- "deployed behavior matches upstream RFC 9162 implementations" -> this
was false; the deployed verifier OMITTED RFC 9162 Step 7, and a
faithful RFC verifier rejects the same lied-size family. The claim is
quoted in the closure note only to refute it.
- "the deployed RFC 9162 iterative algorithm" -> "the deployed iterative
verifier (an RFC 9162-style loop, but see root cause)"; the mislabel
(assuming conformance) is precisely what let the two-way harness file
the divergence as a scoped gap instead of a bug.
The historical divergence remains recorded in public entry 13 and
reproducible at the tagged pre-fix commit; entry 13, the attested
accumulator commit 172a1d0, and the IACR submission PDF are unchanged.
Gap 15 (deployment refinement invariant) remains open.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part II rewritten (doc-only; the attested freeze 172a1d0 is untouched).
The earlier draft claimed the resemblance 'is not a metaphor', called
the extractors fraud proofs 'in the strict sense', and said the system
'cannot fail to convict' — the same compressed overclaims the paper
removed in its round-12 revision. Now: the extractors are REDUCTION
WITNESSES against SHA-256 collision resistance (accepting a forged
consistency proof would break the hash; it does not by itself prove
operator misconduct); the one direct-attribution mechanism is
equivocation evidence (two conflicting signed heads, same size, one log
context — signature layer, not hash layer); a fabricated LEAF is caught
only by off-protocol independent replay. Three disanalogies stated
plainly; the entry-13 closing reframed to the plain fact, no metaphor
needed. Framing note added at top disclosing the correction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Same principle as the estate map: public docs should not enumerate
private entities by name. The three references now say 'the private
infrastructure repo'; commit references and procedure content unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The paper was reinvented (new title, new section/theorem numbering, old
report archived at /paper/v0.2), which made this repo's paper references
ambiguous — worst case: KNOWN-GAPS gap 14/15 cites 'paper §5.3/§5.4'
meaning the OLD report's pin-store sections, while the CURRENT paper's
§5.3/§5.4 are entirely different content. Fixes:
- README: points to the archived v0.2 (the version this corpus was built
against) AND the current paper (which presents the results in its §5
and carries this corpus as entry 13).
- STATEMENT-MAP + KNOWN-GAPS: explicit numbering notes — all 'paper §N'
references are v0.2 numbering; do not match against the current paper.
- ATTESTATION-RUNBOOK facts table: the 'log' row claimed 12 leaves
FROZEN and the 'entry 13' row claimed 'does not exist yet' — both now
state execution-time vs current state (13 leaves, 3488a2d0, entry 13
live; the runbook is the record of that execution).
No Lean, verification, or attestation content touched; the attested
freeze commit 172a1d0 is unaffected (attestation pins the commit, not
the branch).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The header still called the essay a 'parked blog-post source' awaiting
entry 13, and two future tenses ('will carry') survived — the blog is
published and entry 13 is live. Caught by a fresh-pattern sweep after
the hand-picked patterns of the first documentation pass missed them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The corpus is now leaf index 12 of the log it describes. Status
FROZEN→ATTESTED; the 'attestation is a separate operator decision' line
is now the completed fact, with the live head, leaf hash, prefix
relation, and scope (KNOWN-GAPS 14/15) stated. Six review rounds noted.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The log now carries kernel-checked proofs of its own machinery. Subject
ltl-accumulator-verified@172a1d0, 61/61 proven+clean, mechanized-model
scope (KNOWN-GAPS 14/15). Consistency 12→13 accepted by both the
deployed verifier and the mechanized model; live-consumer-verified.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The drill caught: committing the paper outline advanced the pacta
working tree 8b1a325→84e0eb8, so the release tuple's exact-SHA
PACTA_COMMIT=8b1a325 was already stale and B1b's 'HEAD==PACTA_COMMIT'
would have falsely aborted. Verified 8b1a325..84e0eb8 touches ONLY
paper/ (zero producer code). Fixed the invariant to pin the producer
CODE (PACTA_CODE_BASE=8b1a325, git diff -- src provider must be empty),
tolerating doc-only commits above it — the correct thing to pin is the
reviewed producer code, not an ephemeral HEAD.
Drill also re-confirmed by execution (not from Opus-session logs):
operational append base pristine (12 entries, root bcd15f9d, max index
11, mtimes Jul 7 — uncontaminated by any rehearsal); B1 clean-room exit
0 + ATTESTATION GREEN with fidelity; live log 12/bcd15f9d; producer
suite 115/115.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Execution found: the append signs with the verified-dalek-serial
dogfood backend, which needs BOTH the built binary (dogfood/state/) and
the key (provider/state/local-provider/) — neither exists in a fresh
clone (a fresh clone fails the wallet dogfood-signer test, orthogonal
to the log path). B1b now verifies the operator's working tree is at
PACTA_COMMIT, tracked-clean, binary present, suite green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two defects found in the first minutes of Phase B, both in my own check
text, both would have misfired on a PRISTINE log:
- B0 'exactly 12 entries under entries/' counted 16 (the live log has
12 numbered leaves + 4 per-component <name>.attestation.json
convenience pointers). Now counts entries/[0-9]*.json and trusts the
STH tree_size.
- B3 'exactly 4 changed paths, receipts unchanged' was WRONG: publish
regenerates every component's inclusion-proof receipt against the new
head (correct CT behavior). Empirically captured on a throwaway
publish over the real published clone: 9 changed paths (3 new + STH +
history + 4 recomputed receipts); numbered leaves 0..11 and existing
attestation pointers byte-identical; provider.ed25519.pub unchanged
under the real key. The old check would have falsely aborted a
correct append.
Neither is a log problem — the log is pristine (12 leaves, bcd15f9d).
The rehearsal missed both because it checked only numbered-leaf
immutability; live-state execution caught them, as B0 is designed to.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Self-audit of the round-6 fix batch (operator-ordered drill) found and
fixed in this file:
- §2a pinned the producer at 87ef2a1 — but the GREEN 12→13 rehearsal
ran at d937a94, and 87ef2a1 LACKS the leaf-scope fix. The stale-pin
defect class (round-6's own critical) reintroduced within hours;
now names all three required pacta commits and the rehearsal commit.
- B0/A4 carried a FALSE mechanism claim: 'published leaf projections do
not rebuild the tree'. Executed check: they DO (hash each stored leaf
as-is; per-entry hashes match; root == bcd15f9d). The real trap is
double-wrapping on re-append. Both texts corrected — a wrong reason
in a runbook breeds future misdiagnoses.
- B2 called the candidate 'UNSIGNED' — check signs at generation; the
gate is inspect-before-APPEND. Reworded (+ B6 digest field renamed).
- Facts header said 'round-4 freeze'; key row said 'no second copy
exists' (contradicting A3b done); kit row stopped at round 4;
Phase-A heading still waited for IACR. All updated.
- B3c renamed B3b (there was no B3a/B3b sequence).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both round-6 reviewers' critical/high procedural findings:
- CRITICAL (both): runbook pinned the wrong commit (2da0a79 in the
facts table, B1 checkout, A4) while the reviewed subject and the
scoped-wording config live in 172a1d0. Re-pinned everywhere;
remaining 2da0a79 mentions are explicitly historical. Added §2a
release tuple (SUBJECT_COMMIT/PACTA_COMMIT/EXPECTED_OLD_SIZE/
EXPECTED_OLD_ROOT/KEY_FINGERPRINT) that every Phase-B step consumes.
- A2: "14 entries" → 15, with the dynamic grep count and gap 15 called
out as the claim-constraining one.
- GPT §10: new B0 — preflight the LIVE predecessor (size/root/STH-sig/
witness-audit-under-real-key/live-service/mirror agreement/no partial
entry 13/operational-state roots to bcd15f9d). An append-only system
re-reads its predecessor; it does not trust a Facts table.
- GPT §4: new B1b — clone + checkout + clean-tree + green-suite the
pinned PACTA_COMMIT; that is the only producer used.
- GPT §5 + both: new B2b candidate-leaf inspection gate (subject commit,
61/61 proven+clean, scope.deployment_constraints carries the required
wording and not the forbidden phrase, scope.exclusions complete) —
inspect before you append a leaf you cannot take back.
- GPT §11: exact changed-path set + prefix immutability (entries
0..11 byte-identical, one appended history line) instead of
"exactly four paths" by description.
- GPT §7/§8: B6 binds sanitized evidence (subject/producer commits,
config + candidate + fidelity-transcript digests, old/new roots,
consistency + witness + pin results) so the leaf's fidelity clause
points at a concrete object.
A4 redone as a structural 12→13 rehearsal (GPT Method B) — green:
predecessor copy roots to bcd15f9d, candidate 61/61 with scoped wording
IN THE LEAF, append→13, prefix immutability, consistency 12→13 accepted
by deployed AND mechanized model. Transcript on SD. Facts table:
pacta freeze lifted; producer = round-6 PACTA_COMMIT, not 3d81d53.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-4 verdicts: Claude reviewer — nothing blocks the freeze, no
remaining findings; GPT-5.6 — approve after minor documentation fixes,
attestation scoped to the mechanized model. This round is those fixes;
no Lean surface changed.
- 218/59 → 222/61 everywhere, and STRUCTURALLY: check.sh Phase 3c
asserts the audit counts (STATEMENT-MAP + README vs allowlist/CONES)
and the four fidelity pins (STATEMENT-MAP vs run_fidelity.py
constants) on every run — stale-count drift is a red button now
(R4-1, third recurrence of the class).
- Gap 14 reworded to evidence-vs-inference (the invariant "is assumed",
not "transfers"), witnesses cited (paper §5.3/§5.4; pacta
sthstore.py/logclient.py — outside the fidelity target). New gap 15:
deployment refinement invariant unmechanized (GPT's principal
finding, split out because it carries the deployed-soundness claim).
- Runbook: A1 marked done (both approvals on SD); B2 gains the REQUIRED
scoped attestation wording (GPT §11) as a gate condition — entry 13
cannot claim "deployed verifier formally verified".
- run_bare.sh fail-closes on Lean version AND commit (rejection path
tested with a fake toolchain: FATAL, exit 1).
- Harness: "consistency baseline family" line (GPT §8); gap 14 says
"fixed offsets n−1/n+1/n+7" (R4-5).
- RESPONSE round 5, incl. refutation of GPT §7 (the target tarball
demonstrably contains MANIFEST.sha256 + TARGET-PROVENANCE.md; the
round-5 kit also ships both unpacked as a courtesy).
check.sh exit 0 ATTESTATION GREEN (Phases 0-4 incl. new 3c); selftest
exit 0, 9/9 + control. Live LTL untouched (12 leaves, bcd15f9d…).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Parked blog-post source, publishes after entry 13 (so it can end with
a live leaf link). Part I: the tree holds verification-event records
(operator claims that name their own evidence via commit+toolchain
pins), not the Lean proofs; three-layer guarantee table (kernel /
replay pin / accumulator). Part II: the optimistic-rollup resemblance
made precise — two fraud layers (log-layer: Theorem 3 as a
constructive fraud-proof generator; claim-layer: replay with an
infinite challenge window), the honest enforcement gap (reputational
vs economic slashing, CT lineage), the watcher/liveness assumption,
and the inversion (validity-proven payload in an optimistic envelope;
entry 13 = formally verified fraud-proof machinery).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The append driver was never lost: pacta's committed provider/ CLI
(check / log-append / log-publish) produced leaves 8-11, signing heads
with the verified-dalek-serial dogfood backend (self_inclusion:
verified). Only the per-run orchestration was session work — A4 is now
rehearsal + private documentation, not reconstruction. A3: private key
located laptop-side (0600, gitignored state dir; public half
byte-matches provider.ed25519.pub); exact path deliberately excluded
from this public file. A3b: the key has NO second copy anywhere —
encrypted SD backup procedure added as a Phase-A blocker.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The droplet serves a DERIVED log dir rebuilt from a published/ mirror
(PersonalCloudServer DEPLOY.md § 'The LTL service') — B4 now refreshes
published/ and runs reconstruct.py instead of a bare app pull. Facts:
signing key verified NOT on the droplet (server only serves); server
deployment now version-controlled in private PersonalCloudServer@a186bac
(md5-verified == droplet).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Corrected the facts table (mirror URL scheme zkdefi.org/saymrwulf/,
nightly reconcile path + log) and replaced the server-side A5 with an
anonymous seven-repo GitHub==Forgejo head comparison.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Single authoritative ToDo between now and leaf index 12. Phase A (now):
reviewer confirmations, author statement read, operator-only key
confirmation (openssl pubkey diff against provider.ed25519.pub),
reconstruction of the never-persisted append driver (found 2026-07-12:
the leaves 8-11 driver was session work), Forgejo mirror verification.
Phase B (gated on ePrint decision + fresh explicit operator order):
clean-room button run, driver append, witness-audit, consumer
sth-refresh 12->13, publish, live checks, mirrors, SD archive. Iron
rules, failure protocol, and an Agent Appendix (key handling forbidden
to agents; the fifth gate condition cannot be satisfied from files).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-3 verdicts: GPT-5.6 conditionally approves (blockers closed, one
portability finding); the Claude reviewer's Socratic addendum produced
F1*, the strongest finding of the series — deployed verify_consistency
and mechanized ConsRec are NOT extensionally equal. Reproduced exactly
(witness verify_consistency(1,3,R2,R3,P(2→3))=True vs ConsRec reject;
3,405 divergences n<60; strictly one-sided; power-of-two seeding
mechanism confirmed in source).
- KNOWN-GAPS gap 14: witness, mechanism, one-sidedness, and the
pinned-pair side condition under which Theorem 3 transfers to the
deployed verifier (pacta's pin-store flow supplies it by
construction). No pacta code change; deployed behavior matches
upstream RFC 9162 implementations.
- fidelity: lied-size family — 73,573 boundary cases, 3,867 expected
divergences PINNED, one-sided direction asserted per case. Banner
rescoped: agreement over pinned families, not extensional equality.
- Theorem3.lean: acceptCons_sound (F2) — soundness over the named
acceptCons predicate, n₀=0 discharged from the non-prefix premise,
size bound derived from acceptance via new consRec_some_le. Cones
read from #print axioms; CONES/AxiomCheck/allowlist updated
(218 → 222 constants, diff = the two theorems + two generated
auxiliaries).
- F3/GPT§7: verification/lean-toolchain pin + run_bare.sh (reviewer's
standalone runner, plain public lean — verified green: 61 cones, 222
constants, gate green) + AENEAS_ENV override in check.sh and
selftest_audit.sh.
- F4: awk field-equality replaces regex-with-dots in Phase 3b.
- F5: git-tracked .pyc removed (worse than reported — it was in the
repo, not just the kit); __pycache__ gitignored; round-4 kit ships a
corpus MANIFEST.sha256 + pinned commit (also GPT's governance
condition).
check.sh exit 0, ATTESTATION GREEN; selftest exit 0, 9/9 + control.
Live LTL untouched (12 leaves, bcd15f9d…); attestation still gated on
ePrint decision + author review + explicit operator order.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-2 external reviews (GPT-5.6 + second Claude) converged on the
coverage gate being evadable (H1/NEW-1); GPT additionally proved the
kit's fidelity target could not run (H2) and the namespace-collision
attack that defeats any source-regex fix. This round adopts GPT's
required correction in full:
- Proofs/Inventory.lean: declaration inventory read from the compiled
Lean environment — every constant of every corpus module, fully
qualified, unfiltered (compiler auxiliaries and _private mangles
pinned too), with kind and axiom cone; own cone walker cross-checked
in-process against core collectAxioms (hard error on divergence).
- verification/inventory-allowlist.txt: all 218 constants pinned.
- inventory_gate.sh: fail-closed diff both directions (UNCLASSIFIED /
STALE), INV-COUNT truncation guard, exactly-one-axiom invariant.
- check.sh Phase 3b rewritten around the gate + manifest⇔inventory
drift checks + CONES⇔inventory cone cross-check (two independent
computations must agree). EXCLUDE table gone (sha256/Bytes are
ordinary audited entries now).
- selftest_audit.sh: 9 adversarial cases against the production gate
(attributed/indented/private/instance, namespace collision, smuggled
axiom, deleted decl, unmanifested Proofs/ and gen/ modules) + positive
control — all defeated (GPT release condition 2).
- M1: recursive orphan-olean guard (caught a stray dev artifact on its
first run), gen/ dead-file check, corpus-wide single-axiom pin.
- L1/NEW-2: acceptIncl_sound drops the redundant hm (derived from
hacc.1); cone unchanged.
- M2/M3: STATEMENT-MAP counts 230,271/230,016; non-vacuity guard
wording narrowed to what the guards actually certify.
- README layer table: stale L4/pin-store rows fixed (missed by both
round-2 reviewers AND the round-2 revision — found in self-review).
- KNOWN-GAPS 12 (audit-gate lineage + residual limits), 13 (round-2 kit
target not self-contained); gap 2 count fixed.
- RESPONSE-TO-REVIEWERS.md: round-3 disposition of every finding.
Kit round 3 additionally ships the complete stdlib-only import closure
of pacta.transparency (content-addressed vs pacta 3d81d53), the
clean-extraction fidelity transcript (exit 0, 230,271+230,016, zero
mismatches), the ATTESTATION GREEN check.sh transcript, and the
self-test transcript.
The live LTL remains untouched (12 leaves, root bcd15f9d…);
attestation stays blocked pending ePrint decision + author review +
explicit operator order.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
No theorem was wrong; every fix is spec-surface, audit-mechanism, docs,
or harness coverage. Changes:
LEAN (Claude F1, GPT M4):
- acceptIncl: the consumer's inclusion accept (m<n ∧ Root=some r) is now
a named object, not just a theorem hypothesis. Root alone accepts
out-of-range m; acceptIncl pins the guard.
- acceptIncl_complete / acceptIncl_sound: route Thm 1/2 through it.
- extractCons_correct_paper: Thm 3 at the paper's exact quantifiers
(n₀≤n₁, no separate 0<n₀; n₀=0 discharged since D₀=[]=take 0).
SCRIPT (GPT H1/H2, Claude F3):
- Phase 3b: fail-closed audit-surface COVERAGE — every named decl under
Proofs/ and gen/ must be in CONES or a documented EXCLUDE (sha256,
Bytes); anonymous gen instances count-pinned; every CONES key must be
queried by AxiomCheck (no pin-but-never-check). Tested: an
unclassified theorem now makes the button exit 1.
- H2: distinct markers — LEAN GREEN always, ATTESTATION GREEN only when
fidelity actually ran; SKIP/absent-pacta no longer emit the strong
marker. Attestation gate keys on ATTESTATION GREEN.
- Phase 0: orphan-olean guard (every Proofs/*.olean needs a sibling
.lean); deleted 6 orphans; untracked all *.olean/.lake from git and
gitignored them (root cause of the F3 tarball leak).
HARNESS (Claude F1, GPT M3):
- added out-of-range families (m≥n, m>n, n₀>n₁, n₀=0); re-pinned counts
230,271 / 230,016 (match the reviewer's independent RFC difftest
exactly); narrowed 'exhaustive' wording to the tested domain.
DOCS: README stale rows fixed (freeze banner no longer contradicts
table); KNOWN-GAPS gap 3 reworded (general Lemma 2 = specializations),
+gaps 9 (cost), 10 (pin init), 11 (acceptIncl resolved); STATEMENT-MAP
+acceptIncl rows, +Lemma-2-general note, +constant-vs-property
clarification for §10(i).
Button: EXIT 0, coverage complete, ATTESTATION GREEN, 230,271/230,016.
56 pinned cones over an ENFORCED surface. LTL untouched (12, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- STATEMENT-MAP.md: the review surface — every paper §6/§10 item mapped
to its Lean name, file, and cone; the named-extractor design invariant
and the anti-pigeonhole guards explained; the audit surface stated.
- KNOWN-GAPS.md: eight honest scope boundaries, including the process-
history candor item (the guessed-pins/false-green episode and its fix).
- README: frozen banner. Final sweeps: button EXIT 0 + ALL GREEN +
FIDELITY GREEN; zero sorry; the only ∃-conclusions are content-bearing
(kbelow_pow2) or hypothesis-guarded helpers — no collision
existentials anywhere.
Corpus: 54 pinned cones over a defined surface, single sha256 boundary,
Lemma 1 axiom-free, Theorems 1-3 + Prop 1(1) + whole-tree Lemma 2 +
fidelity 164,479/164,224. Frozen at this commit pending external review.
LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Audit-of-the-coverage-audit. Its 18 added cone values re-verified against
the observed #print outputs (all match). Methodology blind spots found:
abbrev Bytes (bare alias, no cone content — excluded by nature) and the
two ANONYMOUS gen/ instances, which are silently load-bearing
(DecidableEq Hash powers ConsRec's 'if C = []' and pinAccept's root
compare; Inhabited Hash powers every getD default). Transitivity covered
them, but no hand-waves before external review: cones read and pinned —
instInhabitedHash = [propext], instDecidableEqHash = AXIOM-FREE. The
audit-surface definition is now documented in check.sh itself.
Button verified by exit code: EXIT 0, ALL GREEN, FIDELITY GREEN.
54 pinned cones. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Re-derived S7 as Fable, practicing the standing rule (check exit code +
ALL GREEN, not tail). Confirmed committed button genuinely exits 0.
FINDING: the cone audit had a COVERAGE gap — 34 of 52 proven objects
were pinned; 18 (incl. core defs kbelow/hleaf/hnode and the pin-store
defs pinAccept/pinExtract/acceptCons, plus intermediate lemmas) were
never cone-audited. Transitively safe (Phase 1 forbids axiom under
Proofs/, Phase 2 forbids sorry, universally) — but 'transitively
covered' is not good enough for an externally-reviewed corpus. Closed:
every proven theorem/def now has its EXACT cone pinned, read from
#print axioms (not guessed). Coverage now 52/52, empty unaudited list.
Cones of note: hleaf/hnode = [LTLAcc.sha256] only; kbelow and the pure
arithmetic/list helpers = no hash axiom; the def-level objects that
touch MTH carry the single sha256 boundary. No surprise axioms anywhere.
Button verified: EXIT 0, ALL GREEN, FIDELITY GREEN, 164,479/164,224
pinned. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
FIDELITY (the deliverable): fidelity/lean_defs.py transliterates the Lean
MTH/Path/Root/ConsRec (post-refactor decidable-if base) to Python;
fidelity/run_fidelity.py differential-tests them vs the DEPLOYED pacta
verifiers over test_paper_verifiers.py's exact case generation. Result:
MTH==merkle_root (256), Path==inclusion_proof (32,896), verifier
agreement over 164,479 inclusion + 164,224 consistency cases (incl.
honest consistency). Pinned counts match the paper. Wired as check.sh
Phase 4 (gated on pacta presence, SKIP_FIDELITY to skip).
HONEST CORRECTION: three cone pins added in S5.3-S6 were WRONG
(take_all and consRec_base_true_eq are [propext]; consRec_base_false_eq
is [propext, Classical.choice, Quot.sound]) — I had guessed
[propext, Quot.sound]. check.sh's Phase 3 audit was therefore EXITING 1
since S5.3, but I reported 'green' from tailing cert lines instead of
checking the exit code / ALL GREEN. Pins now corrected to the observed
cones; the button now genuinely exits 0 with ALL GREEN + FIDELITY GREEN.
No THEOREM was ever wrong (kernel-checked); the failure was the audit
harness rejecting mis-pinned cones — working as designed, caught late by
my process gap. Process fixed: verify exit code + ALL GREEN, never tail.
35 certs green (verified by exit 0). LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The consumer pin store (§5.4) as a transition predicate; the paper's
Prop 1(1) fully mechanized:
- pinAccept: same-size ⇒ root match; smaller ⇒ reject (rollback); larger
⇒ consistency proof verifies. Mirrors sthstore.py.
- pinAccept_monotone: an accepted step never shrinks the pin (definitional).
- pin_prefix_correct: an honest advance where D is NOT the prefix of D'
makes pinExtract output a genuine collision — same-size routes to
extractMTH (whole-tree Lemma 2), grow routes to extractCons (Theorem 3).
Explicit named-extractor form ⇒ non-vacuous (pin_prefix_nonvacuous
pinned).
- fork_distinct: the Merkle share of Prop 1(2) — different roots at equal
size commit to different content. EUF-CMA transferable-evidence is
signature-layer, OUT OF SCOPE and documented in the file header (not
smuggled).
Cones: single hash axiom (pin_prefix_correct adds Classical.choice via
functional induction downstream). 33 certs green. Fable statement-audit:
matches paper Prop 1(1); Prop 1(2) scope-bounded honestly. LTL untouched.
Every §6 statement is now kernel-checked: Lemma 1, Theorems 1-3,
whole-tree Lemma 2, Proposition 1. Remaining: S7 fidelity, S8 freeze.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The previous drill's equivalence theorems were only as strong as their
RHS matching the ACTUAL historical base (not a from-memory
reconstruction) and 'nothing else changed' being true. Both now verified
against the repository itself: git show cfde9b2 confirms the RHS forms
verbatim; git diff cfde9b2..8795e82 confirms the refactor is base-only
(eight lines). Provenance recorded in Refactor.lean's header so the
argument is self-contained: unchanged remainder (git) + equal base
(kernel) => whole-function equality. 26 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Re-derived S5.3 (all done under an Opus switch) from zero. consRecBinding
STATEMENT re-confirmed faithful to paper Thm 3 steps 1-2 (y=MTH D₁ = the
hash-fold condition; some=>collision / none=>x=MTH(D₁.take n₀) = the two
Lemma-2 outcomes); non-vacuous (some-branch is a SPECIFIC-pair IsCollision,
not pigeonhole-provable; none-branch a real equality needing hcons).
FINDING + FIX: Opus changed ConsRec's base definition (list-match →
decidable if) with only 'recompiled clean' as evidence — a definition
that mirrors the deployed verifier. Now machine-checked: consRec_base_
false_eq / consRec_base_true_eq prove the decidable-if base EQUALS the
exact list-match forms it replaced. Kept as PERMANENT cone-audited
theorems (F1 discipline: keep the evidence), not a throwaway probe.
QUEUED for S5.4: extractCons_correct (Theorem 3 endpoint) MUST carry a
permanent non-vacuity witness like extractIncl_nonvacuous/extractMTH_
nonvacuous. S7 must re-confirm the NEW ConsRec base vs Python.
26 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The single hardest proof in the corpus is complete, no sorry. Under the
value-equality invariant y = MTH D₁, an accepting ConsRec fold either
makes extractConsNode output a genuine collision or its first component
is the honest prefix root MTH(D₁.take n₀).
- ConsRec base changed from list-match to decidable if (if C=[] /
if C.length=1) — same root-cause fix as Root, avoids WF-unfold
exhaustiveness obligations; more faithful to the deployed Python.
Whole chain (Basic..Consistency) rebuilt clean.
- consRecBinding by ConsRec.induct (10 cases): 4 base/singleton, 3
rejection/none contradictions, 2 recursive (n₀≤k, n₀>k). The n₀>k
none-branch is where all S5.1 infrastructure interlocks:
kbelow_prefix_eq (prefix splits at same k) + take_take_le +
take_drop_prefix assemble x = hnode s xx into MTH(D₁.take n₀). The
collision branches use append_inj (fixed-width Hash) + MTH_split.
- take_all helper (take-whole-list).
Cone [propext, Classical.choice, LTLAcc.sha256, Quot.sound] — single hash
axiom. 24 certs green. Fable statement-audit: matches paper Thm 3
steps 1-2. LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Re-derived the planned stage-3 binding against the extractConsNode
definition. Definition is SOUND (candidate/ConsRec hnode alignment
re-confirmed: n₀≤k hnode y s ↔ 0x01::y'++s; n₀>k hnode s y ↔ 0x01::s++y').
FINDING (protects stage 3): extractConsNode's candidate is a
genuine collision ONLY under y_current = MTH(D₁_current) — sha256(LHS) =
hnode y' s = y_current, sha256(RHS) = MTH D₁_current, equal iff the
value-equality invariant holds. The stage-3 binding statement MUST thread
through the recursion (Lemma 2's top-down equality). Planned
statement already carries it; note now flags it as load-bearing so it
can't be dropped.
LEDGER: cfde9b2 claimed the extractor 'verified faithful' — that
overclaimed kernel-verification; it is inspection-only until
consRecBinding is proven. README corrected to say so.
No Lean change (definition sound). 22 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The consistency collision extractor: walks the ConsRec new-root fold in
parallel with the honest size-n tree of D₁ and returns the concrete
colliding node preimage pair at the first level where the fold's hnode
argument pair diverges from the honest node — or none if the fold is
genuine all the way down (binding holds). Both branches verified faithful
to ConsRec's hnode argument order (n₀≤k: y' left / s right; n₀>k: s left
/ y' right). Termination via kbelow bounds.
Deliberate honest checkpoint: the DEFINITION compiles and is cone-audited
[propext, LTLAcc.sha256, Quot.sound]; the binding CORRECTNESS proof — the
single hardest object in the corpus — is stage 3, kept for a fresh
session rather than a rushed long turn. 22 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Theorem 3's binding (steps 1-2) turns on one non-obvious arithmetic fact,
isolated and proven here before the main proof:
- pow2_exp_unique / kbelow_eq_of_pow2_between: kbelow is pinned by its
three defining inequalities (power-of-two, k<n≤2k), so a prefix that
spills past the left subtree splits at the SAME point.
- kbelow_prefix_eq: with k=kbelow n, 2≤n, k<n₀≤n ⇒ kbelow n₀ = k (the
fact the n₀>k recursion branch needs to align MTH(D₁.take n₀) with the
fold).
- take_take_le, take_drop_prefix: the list-surgery identities relating
(D.take n₀) to D.take k and (D.drop k).take (n₀-k).
Cones pinned; 21 certs green. Deliberate honest checkpoint — binding +
extractCons assembly is the next stage. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adversarial re-derivation of S4. The mathematics HOLDS: extractMTH_correct
is faithful to paper Theorem 3 step 3 (hypotheses, recursion, node/leaf
collision cases all re-verified), sub-call length/difference obligations
sound, non-vacuity witness valid.
The defect was in the CLAIM: S4's commit/README stated extractMTH
'restores the receipt-uniqueness content of Lemma 2'. Wrong instance.
Lemma 2 has three instantiations; the deleted root_binding was the PATH
instance (uniqueness of accepting receipts (v,P) for Root, quantifying
over adversarial paths); extractMTH is the WHOLE-TREE instance (MTH
injective on equal-length leaf lists). Nothing in the corpus currently
states path-uniqueness. Ledger corrected: whole-tree instance done;
path instance honestly listed as deleted-and-not-restored (optional —
not needed for Theorem 3 assembly).
No Lean changes; 18 certs remain green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The 'descend' step of the paper's Theorem 3, built extractor-first per
the S3.5 lesson (never a bare '∨ collision'):
- extractMTH (D D'): total function that, given two equal-length leaf
lists sharing a Merkle root, walks the common-shape tree to the first
divergence and returns the concrete colliding preimage pair (a node
pair, or a leaf pair at the bottom).
- extractMTH_correct: |D|=|D'| ∧ D≠D' ∧ MTH D = MTH D' →
IsCollision (extractMTH D D'). Proven by functional induction on
extractMTH; composite case uses MTH_split + append_inj (fixed-width
Hash) to split node preimages or exhibit the node collision.
- extractMTH_nonvacuous: equal lists → output NOT a collision (pinned),
so the conclusion is false for some inputs ⇒ choice-proof.
This also RESTORES, in explicit non-vacuous form, the receipt-uniqueness
content of Lemma 2 deleted in the S3.5 cleanup (re-audit F2): the honest
Merkle fold is injective up to a collision.
18 certs green. Fable statement-audit passed (matches paper Thm 3 step 3
verbatim). LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adversarial re-derivation of S3.5 (drill after harness switch). Core
verdict CONFIRMED: extractIncl_correct is faithful and non-vacuous.
Three methodical flaws found and resolved:
- F1: the non-vacuity proof existed only as a deleted probe — evidence
discarded. Now permanent: extractIncl_nonvacuous proves the
extractor's output on a NON-forgery input is NOT a collision, so the
correctness conclusion is false for some inputs and cannot be
discharged by pigeonhole/choice. Guards against future drift back
into vacuity. Cone pinned.
- F2 (queued for S4): deleting root_binding discarded the receipt-
uniqueness content of Lemma 2 (left disjunct: P = Path m D) along
with its vacuous disjunct. To be restored in extractor form during
S4; the S4 consistency walk inlines the same argument regardless.
- F3: README still claimed 'root_binding done' — a deleted theorem
advertised as delivered. Ledger corrected.
15 certs green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The S3 Socratic re-audit found incl_sound was kernel-perfect but VACUOUS:
its '... ∨ HasCollision' disjunct (∃ x y, x≠y ∧ sha256 x = sha256 y) is
provable by pigeonhole ALONE (sha256: infinite List UInt8 → finite
32-byte Hash), so the theorem said nothing about forgeries. Even a
data-carrying {p // IsCollision p} disjunct fails (Classical.choice
inhabits it). The only faithful rendering of the paper's 'explicit
algorithm 𝓔' is a NAMED FUNCTION whose correctness is a claim about ITS
OUTPUT.
- extractIncl (m D d P): total function that walks the honest tree and
returns the concrete colliding preimage pair at the first divergence
(a node preimage pair, or the leaf preimage pair at the bottom).
- extractIncl_correct: d ≠ D[m] ∧ accepting-receipt →
IsCollision (extractIncl …).1 (extractIncl …).2. A statement ABOUT the
fixed function's output; pigeonhole cannot discharge it.
ADVERSARIAL CHECK (probe, since removed): proved
¬ IsCollision (extractIncl 0 [[7]] [7] []) — i.e. on a NON-forgery input
the output is provably NOT a collision, so the conclusion is genuinely
false for some inputs ⇒ non-vacuous, choice-proof.
- Removed the vacuous theorems entirely (incl_sound, root_binding,
hnode/hleaf_inj_or_collision, HasCollision def) so no hollow statement
survives in a corpus destined for the log. Kept the real building
blocks (hnode_preimage_inj [propext]; eq_dropLast helper moved to
Completeness; Binding.lean deleted).
extractIncl_correct cone [propext, Classical.choice, LTLAcc.sha256,
Quot.sound]. THE button green (14 certs). Fable statement-audit passed.
LTL untouched (12 leaves, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The crux layer — the statement whose HAND proof once carried the frontier
coverage bug is now kernel-checked.
- gen: hash outputs refactored to Hash = {l : List UInt8 // l.length = 32}.
MECHANIZATION FINDING: the paper's pair-coincidence step ('equal hnode
values of distinct argument pairs are a collision') is load-bearing on
FIXED-WIDTH outputs — with unconstrained byte strings x++s = X++Y does
not split. hnode_preimage_inj (cone: propext) makes this explicit via
List.append_inj on equal-length components. Queued as a half-sentence
for the paper's next cycle.
- HasCollision := ∃ x y, x ≠ y ∧ sha256 x = sha256 y — appears ONLY as a
conclusion, never a hypothesis (no collision-resistance assumed).
- hnode_inj_or_collision / hleaf_inj_or_collision: the per-node dichotomy.
- root_binding: any accepting reconstruction from (v,P) to the honest root
either IS the honest receipt (leaf hash AND full path P = Path m D — case
(ii) pinning every consumed sibling) or exhibits a collision. Motive
quantifies (v,P); induction on Path; k-fold discipline.
- incl_sound (Theorem 2, position binding): accepting a wrong leaf at m
yields a collision. Cone [propext, Classical.choice, LTLAcc.sha256,
Quot.sound] — the single hash axiom, pinned in check.sh. ALL GREEN.
Also: Root n=1 branch changed from list-match to decidable 'if P = []'
(well-founded unfolding generated a spurious exhaustiveness obligation);
Root_one_cons added. Fable-5 statement-audit passed. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adversarial statement-level re-verification of everything S2 shipped,
against paper SS5.3 and the deployed Python verifier: Path recursion,
Root_left/Root_right fold shapes (none exactly where the deployed code
rejects), incl_complete as Theorem 1 verbatim (getD default unreachable
under m < |D|), MTH([]) = H(epsilon) per RFC. All faithful.
One genuine gap found and closed: the kbelow lemmas bounded k but never
established k is a power of two, leaving 'our split point = the RFC
split point' as by-construction folklore. kbelow_pow2 (cone: propext,
Quot.sound) now pins it: 2^j = k < n <= 2k = 2^(j+1) uniquely
determines the RFC 9162 split. THE button green. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Path (prover-side inclusion path, paper SS5.3) with termination via the
kbelow bounds; self-contained list lemmas (getD_take, getD_drop - no
stdlib-name dependence); equation lemmas MTH_single/MTH_split/Root_one/
Root_left/Root_right (Option.map form; matcher side conditions closed
explicitly); Theorem 1 by functional induction on Path with a k-fold
discipline against the let-bound split point.
incl_complete cone: [propext, Classical.choice, LTLAcc.sha256,
Quot.sound] - pinned exactly in check.sh alongside Path.
THE button green end to end. LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Accumulator pyramid layers 1-2, mechanizing paper SS5.3/SS6 groundwork:
- gen/LTLAcc/HashExternal.lean: the single sanctioned axiom, opaque
sha256 (no properties assumed - the soundness theorems downstream are
constructive collision extractors).
- Proofs/Basic.lean: hleaf/hnode (0x00/0x01 domain stamps); Lemma 1
(domsep) proven AXIOM-FREE; kbelow (largest power of two below n)
with pos/lt/le-two bound lemmas; MTH, Root (Option = rejection),
ConsRec (four cases, b-flag, pinned anchor) - all with kernel-checked
termination via the kbelow bounds.
- check.sh: estate discipline (stub audit, axiom-smuggling gate,
lean-guard compilation, boundary-exact per-certificate cone audit).
All green; observed cones pinned exactly.
Zero contact with the live LTL: no appends, no server, accumulator
frozen at 12 leaves throughout this project.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
