mrwulf
2da0a79981
Round-3 verdicts: GPT-5.6 conditionally approves (blockers closed, one portability finding); the Claude reviewer's Socratic addendum produced F1*, the strongest finding of the series — deployed verify_consistency and mechanized ConsRec are NOT extensionally equal. Reproduced exactly (witness verify_consistency(1,3,R2,R3,P(2→3))=True vs ConsRec reject; 3,405 divergences n<60; strictly one-sided; power-of-two seeding mechanism confirmed in source). - KNOWN-GAPS gap 14: witness, mechanism, one-sidedness, and the pinned-pair side condition under which Theorem 3 transfers to the deployed verifier (pacta's pin-store flow supplies it by construction). No pacta code change; deployed behavior matches upstream RFC 9162 implementations. - fidelity: lied-size family — 73,573 boundary cases, 3,867 expected divergences PINNED, one-sided direction asserted per case. Banner rescoped: agreement over pinned families, not extensional equality. - Theorem3.lean: acceptCons_sound (F2) — soundness over the named acceptCons predicate, n₀=0 discharged from the non-prefix premise, size bound derived from acceptance via new consRec_some_le. Cones read from #print axioms; CONES/AxiomCheck/allowlist updated (218 → 222 constants, diff = the two theorems + two generated auxiliaries). - F3/GPT§7: verification/lean-toolchain pin + run_bare.sh (reviewer's standalone runner, plain public lean — verified green: 61 cones, 222 constants, gate green) + AENEAS_ENV override in check.sh and selftest_audit.sh. - F4: awk field-equality replaces regex-with-dots in Phase 3b. - F5: git-tracked .pyc removed (worse than reported — it was in the repo, not just the kit); __pycache__ gitignored; round-4 kit ships a corpus MANIFEST.sha256 + pinned commit (also GPT's governance condition). check.sh exit 0, ATTESTATION GREEN; selftest exit 0, 9/9 + control. Live LTL untouched (12 leaves, bcd15f9d…); attestation still gated on ePrint decision + author review + explicit operator order. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
3.5 KiB
ltl-accumulator-verified
Lean 4 mechanization of the security analysis (§6) of the paper
"The Lean Transparency Log" (https://ltl.zkdefi.org/paper): the Merkle
accumulator's own correctness and soundness theorems, kernel-checked, in
the same discipline as the four *-ed25519-verified subject corpora.
Status: FROZEN for external review (corpus complete)
All paper-§10 mechanization targets are kernel-checked; the audit surface
is defined and green (verification/check.sh, exit 0). See
STATEMENT-MAP.md for the paper↔Lean review surface and
KNOWN-GAPS.md for the honest scope ledger.
Revised after review round 1 (GPT-5.6 + second Claude) and round 2:
the audit surface is now an environment-derived inventory
(Proofs/Inventory.lean + pinned allowlist, self-tested by
selftest_audit.sh), the review kit's fidelity target is
self-contained, acceptIncl routes Theorems 1–2, fidelity families
extended (230,271 / 230,016). No changes until the external review
completes. The finished certificates' attestation into the LTL is a
separate, explicitly-authorized operator decision.
| layer | content | status |
|---|---|---|
| L1 | bytes, hleaf/hnode, domain separation (Lemma 1) | done (domsep: axiom-free) |
| L2 | MTH, Root, ConsRec definitions + termination | done (cones: propext, LTLAcc.sha256, Quot.sound) |
| L3 | inclusion completeness (Theorem 1) + named acceptance acceptIncl |
done (incl_complete: propext, Classical.choice, LTLAcc.sha256, Quot.sound) |
| L4 | frontier binding content (Lemma 2) | done as specializations — inlined in the extractor walk (extractIncl), whole-tree (extractMTH), ConsRec (consRecBinding); the standalone Root receipt-uniqueness instance was deleted with the vacuous root_binding in S3.5 and deliberately NOT restored (optional, unused — KNOWN-GAPS gap 3) |
| L5 | inclusion soundness = EXPLICIT extractor extractIncl (Theorem 2) |
done, non-vacuous |
| L6a | descent extractor extractMTH (Theorem 3 step 3 = Lemma 2, whole-tree instance) |
done, non-vacuous |
| L6b | Theorem 3 (consistency soundness): consRecBinding (steps 1–2) + extractCons/extractCons_correct (+ _paper at the paper's exact quantifiers) |
done, non-vacuous |
| L6c | pin-store state machine safety (Proposition 1): pinAccept_monotone, pin_prefix_correct, fork_distinct |
done, non-vacuous (per-step; multi-step chain = gap 7) |
Discipline (identical to the subject corpora)
verification/Proofs/contains ZEROaxiomdeclarations; the single sanctioned axiom site isverification/gen/— here, one opaque function: SHA-256. The theorems are constructive collision extractors, so collision resistance is never assumed, only interpreted.verification/check.shis THE button: compiles every file throughlean-guard(memory cap, core pinning, timeout, single-flight lock) and axiom-audits every certificate against its documented exact cone.- Reviewers without the operator toolchain:
verification/run_bare.shcompiles, axiom-audits, and inventory-gates the corpus with a plain publiclean(version pinned inverification/lean-toolchain); the operator path is overridable viaAENEAS_ENV. - Expected boundary:
propext, Classical.choice, Quot.soundplusLTLAcc.sha256for hash-touching certificates — documented per certificate incheck.sh, audited both directions.
The finished certificates are destined for the LTL itself as attestation leaves: the log carrying kernel-checked proofs of its own machinery.