Round-4 verdicts: Claude reviewer — nothing blocks the freeze, no
remaining findings; GPT-5.6 — approve after minor documentation fixes,
attestation scoped to the mechanized model. This round is those fixes;
no Lean surface changed.
- 218/59 → 222/61 everywhere, and STRUCTURALLY: check.sh Phase 3c
asserts the audit counts (STATEMENT-MAP + README vs allowlist/CONES)
and the four fidelity pins (STATEMENT-MAP vs run_fidelity.py
constants) on every run — stale-count drift is a red button now
(R4-1, third recurrence of the class).
- Gap 14 reworded to evidence-vs-inference (the invariant "is assumed",
not "transfers"), witnesses cited (paper §5.3/§5.4; pacta
sthstore.py/logclient.py — outside the fidelity target). New gap 15:
deployment refinement invariant unmechanized (GPT's principal
finding, split out because it carries the deployed-soundness claim).
- Runbook: A1 marked done (both approvals on SD); B2 gains the REQUIRED
scoped attestation wording (GPT §11) as a gate condition — entry 13
cannot claim "deployed verifier formally verified".
- run_bare.sh fail-closes on Lean version AND commit (rejection path
tested with a fake toolchain: FATAL, exit 1).
- Harness: "consistency baseline family" line (GPT §8); gap 14 says
"fixed offsets n−1/n+1/n+7" (R4-5).
- RESPONSE round 5, incl. refutation of GPT §7 (the target tarball
demonstrably contains MANIFEST.sha256 + TARGET-PROVENANCE.md; the
round-5 kit also ships both unpacked as a courtesy).
check.sh exit 0 ATTESTATION GREEN (Phases 0-4 incl. new 3c); selftest
exit 0, 9/9 + control. Live LTL untouched (12 leaves, bcd15f9d…).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-3 verdicts: GPT-5.6 conditionally approves (blockers closed, one
portability finding); the Claude reviewer's Socratic addendum produced
F1*, the strongest finding of the series — deployed verify_consistency
and mechanized ConsRec are NOT extensionally equal. Reproduced exactly
(witness verify_consistency(1,3,R2,R3,P(2→3))=True vs ConsRec reject;
3,405 divergences n<60; strictly one-sided; power-of-two seeding
mechanism confirmed in source).
- KNOWN-GAPS gap 14: witness, mechanism, one-sidedness, and the
pinned-pair side condition under which Theorem 3 transfers to the
deployed verifier (pacta's pin-store flow supplies it by
construction). No pacta code change; deployed behavior matches
upstream RFC 9162 implementations.
- fidelity: lied-size family — 73,573 boundary cases, 3,867 expected
divergences PINNED, one-sided direction asserted per case. Banner
rescoped: agreement over pinned families, not extensional equality.
- Theorem3.lean: acceptCons_sound (F2) — soundness over the named
acceptCons predicate, n₀=0 discharged from the non-prefix premise,
size bound derived from acceptance via new consRec_some_le. Cones
read from #print axioms; CONES/AxiomCheck/allowlist updated
(218 → 222 constants, diff = the two theorems + two generated
auxiliaries).
- F3/GPT§7: verification/lean-toolchain pin + run_bare.sh (reviewer's
standalone runner, plain public lean — verified green: 61 cones, 222
constants, gate green) + AENEAS_ENV override in check.sh and
selftest_audit.sh.
- F4: awk field-equality replaces regex-with-dots in Phase 3b.
- F5: git-tracked .pyc removed (worse than reported — it was in the
repo, not just the kit); __pycache__ gitignored; round-4 kit ships a
corpus MANIFEST.sha256 + pinned commit (also GPT's governance
condition).
check.sh exit 0, ATTESTATION GREEN; selftest exit 0, 9/9 + control.
Live LTL untouched (12 leaves, bcd15f9d…); attestation still gated on
ePrint decision + author review + explicit operator order.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
