mrwulf
172a1d0653
Round-4 verdicts: Claude reviewer — nothing blocks the freeze, no remaining findings; GPT-5.6 — approve after minor documentation fixes, attestation scoped to the mechanized model. This round is those fixes; no Lean surface changed. - 218/59 → 222/61 everywhere, and STRUCTURALLY: check.sh Phase 3c asserts the audit counts (STATEMENT-MAP + README vs allowlist/CONES) and the four fidelity pins (STATEMENT-MAP vs run_fidelity.py constants) on every run — stale-count drift is a red button now (R4-1, third recurrence of the class). - Gap 14 reworded to evidence-vs-inference (the invariant "is assumed", not "transfers"), witnesses cited (paper §5.3/§5.4; pacta sthstore.py/logclient.py — outside the fidelity target). New gap 15: deployment refinement invariant unmechanized (GPT's principal finding, split out because it carries the deployed-soundness claim). - Runbook: A1 marked done (both approvals on SD); B2 gains the REQUIRED scoped attestation wording (GPT §11) as a gate condition — entry 13 cannot claim "deployed verifier formally verified". - run_bare.sh fail-closes on Lean version AND commit (rejection path tested with a fake toolchain: FATAL, exit 1). - Harness: "consistency baseline family" line (GPT §8); gap 14 says "fixed offsets n−1/n+1/n+7" (R4-5). - RESPONSE round 5, incl. refutation of GPT §7 (the target tarball demonstrably contains MANIFEST.sha256 + TARGET-PROVENANCE.md; the round-5 kit also ships both unpacked as a courtesy). check.sh exit 0 ATTESTATION GREEN (Phases 0-4 incl. new 3c); selftest exit 0, 9/9 + control. Live LTL untouched (12 leaves, bcd15f9d…). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
5.3 KiB
Statement map: paper §6 ↔ Lean corpus
The kernel guarantees every proof below; what a reviewer must vet is the statements — that each Lean theorem says what the paper's item says. This map is the review surface. Paper = "The Lean Transparency Log" (https://ltl.zkdefi.org/paper), §6 and §10 (which scopes the mechanization to items i–v).
| paper item | Lean name | file | cone |
|---|---|---|---|
| §5.3 split point k (RFC 9162) | kbelow + kbelow_pos/lt, le_two_kbelow, kbelow_pow2 (2^j = k < n ≤ 2^{j+1} pins k uniquely) |
Basic | no hash axiom |
| §5.3 MTH | MTH |
Basic | sha256 |
| §5.3 Path | Path |
Completeness | sha256 |
| §5.3 Root (App. B) | Root (Option = rejection) |
Basic | sha256 |
| §5.3 inclusion accept | acceptIncl (= m < n ∧ Root … = some r); acceptIncl_complete, acceptIncl_sound route Thm 1/2 through it |
Basic, Completeness, Extract | sha256 (+choice) |
| Lemma 2 (general abstract form) | not mechanized as one theorem — proved as specializations (see KNOWN-GAPS gap 3); the row below and the Lemma-2 rows are those instances | — | — |
| §5.3 ConsRec | ConsRec (+ machine-checked base-refactor equivalences consRec_base_true_eq/false_eq) |
Basic, Refactor | sha256 |
| Lemma 1 (domain separation) | domsep |
Basic | axiom-free |
| Theorem 1 (inclusion completeness) | incl_complete |
Completeness | sha256 (+choice) |
| Lemma 2, width fact ("65-byte preimages") | Hash = length-32 subtype; hnode_preimage_inj |
gen, Basic | propext |
| Lemma 2, whole-tree instance | extractMTH + extractMTH_correct |
Descent | sha256 (+choice) |
| Lemma 2, ConsRec instance (Thm 3 steps 1–2) | consRecBinding |
Binding3 | sha256 (+choice) |
| Theorem 2 (inclusion soundness, explicit 𝓔) | extractIncl + extractIncl_correct |
Extract | sha256 (+choice) |
| Theorem 3 (consistency soundness, explicit 𝓔′) | extractCons + extractCons_correct; extractCons_correct_paper at the paper's exact quantifiers (n₀=0 discharged); acceptCons_sound routes it through the named acceptCons predicate (size bound derived from acceptance via consRec_some_le). Covers the MECHANIZED accept set; transfer to the deployed verifier is conditional on the pinned-pair side condition of gap 14 |
Theorem3 | sha256 (+choice) |
| Prop 1(1) (pin monotonicity + prefix) | pinAccept, pinAccept_monotone, pin_prefix_correct |
PinStore | sha256 (+choice) |
| Prop 1(2), Merkle share | fork_distinct (different roots ⇒ different content); transferability = signature layer, out of scope |
PinStore | sha256 |
| non-vacuity guards (anti-pigeonhole) | extractIncl_nonvacuous, extractMTH_nonvacuous, extractCons_nonvacuous, pin_prefix_nonvacuous |
Extract/Descent/Theorem3/PinStore | sha256 |
| definition fidelity vs deployed verifier | fidelity/ harness: MTH==merkle_root, Path==inclusion_proof, verifier agreement 230,271 inclusion + 230,016 consistency over the pinned case families — not extensional equality: the lied-size family (73,573 cases) pins the known one-sided divergence of gap 14 (3,867 expected, deployed-accepts-only, direction asserted) |
fidelity | (testing) |
Note on "assumption-free" (paper §10(i)): incl_complete's cone lists
LTLAcc.sha256, but the theorem assumes no property of it — it
merely mentions the opaque constant. Constant-dependence is not
property-assumption; the soundness theorems likewise carry sha256
without assuming collision resistance.
Design invariant of every soundness statement: the collision is the output
of a named extractor function and correctness is a claim about that
output. A bare ∃ x y, x ≠ y ∧ sha256 x = sha256 y is provable by
pigeonhole alone (sha256 maps an infinite domain into the finite 32-byte
type), so it carries no cryptographic content. What the guards certify
(precisely — round-2 M3): each named extractor does not return a
collision on at least one canonical honest input, which rules out the
degeneration where the conclusion is a globally inhabited bare collision
existential. They do NOT establish logical dependence on every listed
hypothesis, nor that no other classical argument could reach the
conclusion on some restricted domain.
Audit surface (enforced by verification/check.sh, exit 0 = green):
the FULL compiled environment of the corpus modules — 222 constants,
read from the Lean environment by Proofs/Inventory.lean (fully
qualified names, kinds, axiom cones) and pinned in
verification/inventory-allowlist.txt, diffed fail-closed both
directions on every run (round-3 replacement for the round-2 source-regex
gate, which GPT H1 showed was evadable). The 61 human-reviewed statement
cones above are additionally checked via #print axioms and
cross-checked against the inventory's independently computed cones.
(These two counts, and the fidelity pins in the table above, are
asserted against the allowlist/CONES/harness by check.sh Phase 3c on
every run — stale-count drift is now a red button, not an erratum:
review R4-1, after three consecutive rounds of hand-edit failures.)
verification/selftest_audit.sh attacks the gate with nine injection
cases (attributed/indented/private/instance declarations, a nested
namespace reusing an audited basename, a smuggled axiom, a deleted
declaration, and unmanifested Proofs/ and gen/ modules) — each must
fail the exact production gate.