saymrwulf/ltl-accumulator-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/ltl-accumulator-verified.git synced 2026-09-05 20:10:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
No description
21 commits 1 branch 0 tags 2.7 MiB
Shell 54.1%
Lean 36%
Python 9.9%
Find a file
mrwulf 260ad64511 revision round 1: address both external reviews (GPT-5.6 + second Claude) 
No theorem was wrong; every fix is spec-surface, audit-mechanism, docs,
or harness coverage. Changes:

LEAN (Claude F1, GPT M4):
- acceptIncl: the consumer's inclusion accept (m<n ∧ Root=some r) is now
  a named object, not just a theorem hypothesis. Root alone accepts
  out-of-range m; acceptIncl pins the guard.
- acceptIncl_complete / acceptIncl_sound: route Thm 1/2 through it.
- extractCons_correct_paper: Thm 3 at the paper's exact quantifiers
  (n₀≤n₁, no separate 0<n₀; n₀=0 discharged since D₀=[]=take 0).

SCRIPT (GPT H1/H2, Claude F3):
- Phase 3b: fail-closed audit-surface COVERAGE — every named decl under
  Proofs/ and gen/ must be in CONES or a documented EXCLUDE (sha256,
  Bytes); anonymous gen instances count-pinned; every CONES key must be
  queried by AxiomCheck (no pin-but-never-check). Tested: an
  unclassified theorem now makes the button exit 1.
- H2: distinct markers — LEAN GREEN always, ATTESTATION GREEN only when
  fidelity actually ran; SKIP/absent-pacta no longer emit the strong
  marker. Attestation gate keys on ATTESTATION GREEN.
- Phase 0: orphan-olean guard (every Proofs/*.olean needs a sibling
  .lean); deleted 6 orphans; untracked all *.olean/.lake from git and
  gitignored them (root cause of the F3 tarball leak).

HARNESS (Claude F1, GPT M3):
- added out-of-range families (m≥n, m>n, n₀>n₁, n₀=0); re-pinned counts
  230,271 / 230,016 (match the reviewer's independent RFC difftest
  exactly); narrowed 'exhaustive' wording to the tested domain.

DOCS: README stale rows fixed (freeze banner no longer contradicts
table); KNOWN-GAPS gap 3 reworded (general Lemma 2 = specializations),
+gaps 9 (cost), 10 (pin init), 11 (acceptIncl resolved); STATEMENT-MAP
+acceptIncl rows, +Lemma-2-general note, +constant-vs-property
clarification for §10(i).

Button: EXIT 0, coverage complete, ATTESTATION GREEN, 230,271/230,016.
56 pinned cones over an ENFORCED surface. LTL untouched (12, bcd15f9d).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-11 22:53:47 +02:00
verification revision round 1: address both external reviews (GPT-5.6 + second Claude) 2026-07-11 22:53:47 +02:00
.gitignore revision round 1: address both external reviews (GPT-5.6 + second Claude) 2026-07-11 22:53:47 +02:00
KNOWN-GAPS.md revision round 1: address both external reviews (GPT-5.6 + second Claude) 2026-07-11 22:53:47 +02:00
README.md revision round 1: address both external reviews (GPT-5.6 + second Claude) 2026-07-11 22:53:47 +02:00
STATEMENT-MAP.md revision round 1: address both external reviews (GPT-5.6 + second Claude) 2026-07-11 22:53:47 +02:00

README.md

ltl-accumulator-verified

Lean 4 mechanization of the security analysis (§6) of the paper "The Lean Transparency Log" (https://ltl.zkdefi.org/paper): the Merkle accumulator's own correctness and soundness theorems, kernel-checked, in the same discipline as the four *-ed25519-verified subject corpora.

Status: FROZEN for external review (corpus complete)

All paper-§10 mechanization targets are kernel-checked; the audit surface is defined and green (verification/check.sh, exit 0). See STATEMENT-MAP.md for the paper↔Lean review surface and KNOWN-GAPS.md for the honest scope ledger. Revised after review round 1 (GPT-5.6 + second Claude): audit surface now fail-closed enforced, acceptIncl named, fidelity families extended (230,271 / 230,016), docs reconciled. No changes until the external review round (second model instance + GPT + author) completes. The finished certificates' attestation into the LTL is a separate, explicitly-authorized operator decision.

layer content status
L1 bytes, hleaf/hnode, domain separation (Lemma 1) done (domsep: axiom-free)
L2 MTH, Root, ConsRec definitions + termination done (cones: propext, LTLAcc.sha256, Quot.sound)
L3 inclusion completeness (Theorem 1) done (incl_complete: propext, Classical.choice, LTLAcc.sha256, Quot.sound)
L4 frontier binding content (Lemma 2) inlined in the extractor walk (extractIncl); standalone receipt-uniqueness theorem queued for S4 restoration in extractor form
L5 inclusion soundness = EXPLICIT extractor extractIncl (Theorem 2) done, non-vacuous
L6a descent extractor extractMTH (Theorem 3 step 3 = Lemma 2, WHOLE-TREE instance) done, non-vacuous
— Lemma 2, PATH instance (receipt-uniqueness of Root): deleted with the vacuous root_binding in S3.5 and not yet restored; optional, not needed for Theorem 3
L6b Theorem 3 (consistency soundness) DONE — consRecBinding (steps 1-2) is the kernel-checked link between ConsRec acceptance and extractConsNode's output; extractCons/extractCons_correct (assembly, joins extractMTH); non-vacuity pinned
L6 pin-store state machine safety (Proposition 1) pending

Discipline (identical to the subject corpora)

  • verification/Proofs/ contains ZERO axiom declarations; the single sanctioned axiom site is verification/gen/ — here, one opaque function: SHA-256. The theorems are constructive collision extractors, so collision resistance is never assumed, only interpreted.
  • verification/check.sh is THE button: compiles every file through lean-guard (memory cap, core pinning, timeout, single-flight lock) and axiom-audits every certificate against its documented exact cone.
  • Expected boundary: propext, Classical.choice, Quot.sound plus LTLAcc.sha256 for hash-touching certificates — documented per certificate in check.sh, audited both directions.

The finished certificates are destined for the LTL itself as attestation leaves: the log carrying kernel-checked proofs of its own machinery.