STATEMENT BINDING (Phase 3d). The coverage gate pins every constant's name,
kind and axiom cone, both directions, and none of selftest_audit.sh's nine
attacks defeat it. It is nevertheless blind to what a declaration SAYS — and
that is demonstrated here rather than argued:
Wrapping one branch of `LTLAcc.pinAccept`'s body in `id (…)` is
definitionally equal. Every downstream proof still compiles. The name, the
kind, the type and the axiom cone are unchanged. The inventory gate reports
"222 constants, environment == allowlist" — GREEN.
That edit is harmless by construction; the point is that nothing stood between
it and a genuinely vacuous redefinition of a specification. Proofs/Inventory.lean
now also emits, for every inventoried constant, its fully-elaborated TYPE, and
for every definition its fully-elaborated BODY — 266 lines over 222 constants.
Proof terms are deliberately absent: by proof irrelevance a theorem's content
is its statement. check.sh Phase 3d binds the SHA-256 and the block is
committed as AUDIT-MANIFEST.txt so a mismatch is DIFFED, not merely reported.
The existing gate is untouched, per the standing rule that the port flows FROM
this repo, not to it: INV lines are byte-identical, inventory_gate.sh is
unchanged, and all nine of its attacks still fail as before.
selftest_statements.sh replays the defeq edit as case 1, asserting BOTH that
the coverage gate passes it and that Phase 3d catches it — so if the coverage
gate ever grows to see this, the test says so instead of quietly re-labelling.
Cases 2-4 cover a hand-edited committed block, a truncated block, and a
constant inventoried without a statement.
FIDELITY PIN (unrelated, found while running the button). Phase 4 had been
failing since 2026-07-23: LIED_PIN_DIV expected 3,867 divergences between the
Lean model and the deployed consistency verifier, and observed 0. Cause is
pacta ddbb5a4, which restored the RFC 9162 2.1.4.2 Step-7 terminal `sn == 0`
condition; that one conjunct removes every divergence in the pinned
73,573-case family. KNOWN-GAPS gap 14 already recorded the closure on the day
it landed — only this constant was stale, so the button had been red for five
days with nobody running it. The pin now reads 0 with the history in a comment.
Nothing about the paper, public log entry 13, or the attested commit 172a1d0
changes; the historical divergence stays reproducible at the tagged pre-fix
commit.
KNOWN-GAPS gap 16 records what the binding does not buy: identity, not
meaning; an author who edits and re-pins in one commit is caught by review and
not by the script; and proof terms are unbound by design.
Button green end to end: ATTESTATION GREEN (Lean + fidelity).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Round-4 verdicts: Claude reviewer — nothing blocks the freeze, no
remaining findings; GPT-5.6 — approve after minor documentation fixes,
attestation scoped to the mechanized model. This round is those fixes;
no Lean surface changed.
- 218/59 → 222/61 everywhere, and STRUCTURALLY: check.sh Phase 3c
asserts the audit counts (STATEMENT-MAP + README vs allowlist/CONES)
and the four fidelity pins (STATEMENT-MAP vs run_fidelity.py
constants) on every run — stale-count drift is a red button now
(R4-1, third recurrence of the class).
- Gap 14 reworded to evidence-vs-inference (the invariant "is assumed",
not "transfers"), witnesses cited (paper §5.3/§5.4; pacta
sthstore.py/logclient.py — outside the fidelity target). New gap 15:
deployment refinement invariant unmechanized (GPT's principal
finding, split out because it carries the deployed-soundness claim).
- Runbook: A1 marked done (both approvals on SD); B2 gains the REQUIRED
scoped attestation wording (GPT §11) as a gate condition — entry 13
cannot claim "deployed verifier formally verified".
- run_bare.sh fail-closes on Lean version AND commit (rejection path
tested with a fake toolchain: FATAL, exit 1).
- Harness: "consistency baseline family" line (GPT §8); gap 14 says
"fixed offsets n−1/n+1/n+7" (R4-5).
- RESPONSE round 5, incl. refutation of GPT §7 (the target tarball
demonstrably contains MANIFEST.sha256 + TARGET-PROVENANCE.md; the
round-5 kit also ships both unpacked as a courtesy).
check.sh exit 0 ATTESTATION GREEN (Phases 0-4 incl. new 3c); selftest
exit 0, 9/9 + control. Live LTL untouched (12 leaves, bcd15f9d…).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Round-3 verdicts: GPT-5.6 conditionally approves (blockers closed, one
portability finding); the Claude reviewer's Socratic addendum produced
F1*, the strongest finding of the series — deployed verify_consistency
and mechanized ConsRec are NOT extensionally equal. Reproduced exactly
(witness verify_consistency(1,3,R2,R3,P(2→3))=True vs ConsRec reject;
3,405 divergences n<60; strictly one-sided; power-of-two seeding
mechanism confirmed in source).
- KNOWN-GAPS gap 14: witness, mechanism, one-sidedness, and the
pinned-pair side condition under which Theorem 3 transfers to the
deployed verifier (pacta's pin-store flow supplies it by
construction). No pacta code change; deployed behavior matches
upstream RFC 9162 implementations.
- fidelity: lied-size family — 73,573 boundary cases, 3,867 expected
divergences PINNED, one-sided direction asserted per case. Banner
rescoped: agreement over pinned families, not extensional equality.
- Theorem3.lean: acceptCons_sound (F2) — soundness over the named
acceptCons predicate, n₀=0 discharged from the non-prefix premise,
size bound derived from acceptance via new consRec_some_le. Cones
read from #print axioms; CONES/AxiomCheck/allowlist updated
(218 → 222 constants, diff = the two theorems + two generated
auxiliaries).
- F3/GPT§7: verification/lean-toolchain pin + run_bare.sh (reviewer's
standalone runner, plain public lean — verified green: 61 cones, 222
constants, gate green) + AENEAS_ENV override in check.sh and
selftest_audit.sh.
- F4: awk field-equality replaces regex-with-dots in Phase 3b.
- F5: git-tracked .pyc removed (worse than reported — it was in the
repo, not just the kit); __pycache__ gitignored; round-4 kit ships a
corpus MANIFEST.sha256 + pinned commit (also GPT's governance
condition).
check.sh exit 0, ATTESTATION GREEN; selftest exit 0, 9/9 + control.
Live LTL untouched (12 leaves, bcd15f9d…); attestation still gated on
ePrint decision + author review + explicit operator order.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
No theorem was wrong; every fix is spec-surface, audit-mechanism, docs,
or harness coverage. Changes:
LEAN (Claude F1, GPT M4):
- acceptIncl: the consumer's inclusion accept (m<n ∧ Root=some r) is now
a named object, not just a theorem hypothesis. Root alone accepts
out-of-range m; acceptIncl pins the guard.
- acceptIncl_complete / acceptIncl_sound: route Thm 1/2 through it.
- extractCons_correct_paper: Thm 3 at the paper's exact quantifiers
(n₀≤n₁, no separate 0<n₀; n₀=0 discharged since D₀=[]=take 0).
SCRIPT (GPT H1/H2, Claude F3):
- Phase 3b: fail-closed audit-surface COVERAGE — every named decl under
Proofs/ and gen/ must be in CONES or a documented EXCLUDE (sha256,
Bytes); anonymous gen instances count-pinned; every CONES key must be
queried by AxiomCheck (no pin-but-never-check). Tested: an
unclassified theorem now makes the button exit 1.
- H2: distinct markers — LEAN GREEN always, ATTESTATION GREEN only when
fidelity actually ran; SKIP/absent-pacta no longer emit the strong
marker. Attestation gate keys on ATTESTATION GREEN.
- Phase 0: orphan-olean guard (every Proofs/*.olean needs a sibling
.lean); deleted 6 orphans; untracked all *.olean/.lake from git and
gitignored them (root cause of the F3 tarball leak).
HARNESS (Claude F1, GPT M3):
- added out-of-range families (m≥n, m>n, n₀>n₁, n₀=0); re-pinned counts
230,271 / 230,016 (match the reviewer's independent RFC difftest
exactly); narrowed 'exhaustive' wording to the tested domain.
DOCS: README stale rows fixed (freeze banner no longer contradicts
table); KNOWN-GAPS gap 3 reworded (general Lemma 2 = specializations),
+gaps 9 (cost), 10 (pin init), 11 (acceptIncl resolved); STATEMENT-MAP
+acceptIncl rows, +Lemma-2-general note, +constant-vs-property
clarification for §10(i).
Button: EXIT 0, coverage complete, ATTESTATION GREEN, 230,271/230,016.
56 pinned cones over an ENFORCED surface. LTL untouched (12, bcd15f9d).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
FIDELITY (the deliverable): fidelity/lean_defs.py transliterates the Lean
MTH/Path/Root/ConsRec (post-refactor decidable-if base) to Python;
fidelity/run_fidelity.py differential-tests them vs the DEPLOYED pacta
verifiers over test_paper_verifiers.py's exact case generation. Result:
MTH==merkle_root (256), Path==inclusion_proof (32,896), verifier
agreement over 164,479 inclusion + 164,224 consistency cases (incl.
honest consistency). Pinned counts match the paper. Wired as check.sh
Phase 4 (gated on pacta presence, SKIP_FIDELITY to skip).
HONEST CORRECTION: three cone pins added in S5.3-S6 were WRONG
(take_all and consRec_base_true_eq are [propext]; consRec_base_false_eq
is [propext, Classical.choice, Quot.sound]) — I had guessed
[propext, Quot.sound]. check.sh's Phase 3 audit was therefore EXITING 1
since S5.3, but I reported 'green' from tailing cert lines instead of
checking the exit code / ALL GREEN. Pins now corrected to the observed
cones; the button now genuinely exits 0 with ALL GREEN + FIDELITY GREEN.
No THEOREM was ever wrong (kernel-checked); the failure was the audit
harness rejecting mis-pinned cones — working as designed, caught late by
my process gap. Process fixed: verify exit code + ALL GREEN, never tail.
35 certs green (verified by exit 0). LTL untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
