mrwulf
9c78ce88ae
CLASS 15 — a Lean file where no phase was looking. The dead-file scan read Proofs/*.lean and gen/LTLAcc/*.lean and nothing else. A module at the verification root, or under any other gen/ subdirectory, was neither compiled nor rejected — while remaining importable by name, since LEAN_PATH contains both roots. That is a source of the corpus that no phase reads and no pin covers, which is exactly what the dead-file gate exists to forbid; it was simply looking in two places instead of everywhere. Now nothing may live in either root but the two enumerated sets. CLASS 9 — the instruments' own declaration surface. AxiomCheck.lean and Inventory.lean perform the audit and are therefore not corpus, so nothing inventoried what THEY declare. Inventory.lean now walks both: AxiomCheck by module index, and itself as the module still being elaborated, whose declarations are the ones the environment reports with no originating module. That is what makes the inventory cover the instrument that produces it rather than exempting itself. The policy is not "declare nothing" — this file legitimately declares its machinery. It is that an instrument may declare only inert definitions. An axiom here would widen the trusted base without appearing in any certificate's cone; a theorem here would be a claim no certificate covers and no allowlist pins. A flat ban on theorems was WRONG and was measured to be wrong: defining a function by well-founded recursion makes the elaborator emit its own obligations, and axiomCone._proof_1 rejected this very file. The distinction that holds is whether a theorem is a claim someone wrote or an artefact of a definition declared alongside it — an artefact's name extends the name of a constant declared with it. Observed surface: 18 declarations, 16 def and 2 generated obligations, no axiom, no standalone claim. The drivers are byte-pinned already, so this does not pin WHICH definitions they contain — that would add a thing to maintain without adding a thing to catch. It adds the property byte-pinning cannot give: that no instrument declares an axiom or a claim, whatever its bytes are. selftest_audit.sh: 10 cases -> 14. Case 12 uses an INDENTED axiom, because Phase 1's source grep catches an unindented one and the point is to reach the kernel-side walk standing behind it. TWO DEFECTS IN THE TEST HARNESS, found while adding the cases. · The scratch tree copied verification/ only, but the button also reads README.md and STATEMENT-MAP.md from the repository root. check.sh therefore ALWAYS died in Phase 3c in the scratch tree, which made every `if check.sh; then <attack not caught>` guard unfirable — check.sh could not pass in there even with no attack at all. Only the diagnostic greps were doing any work. The documents are now copied, and the negative test below proves the guard is live: with the driver-surface check disabled, check.sh PASSES a tree whose inventory driver declares `axiom driver_cheat : False`. · Case 9 was the last case when it was written and left its rogue gen file in place. Harmless then; the new cases inherited it. Cleaned up between the blocks rather than inside case 9, so that case still tests what it did. Also fixed while here: Phase 3b compared the compile manifest against Inventory.lean by grepping the WHOLE FILE for a backticked module name, so prose counted — a doc comment naming a module broke the count, and in the other direction a doc mention of a module missing from the array would have satisfied the presence check and hidden the omission. It now reads the arrays. Both new gates negative-tested by removal. Button green, self-test green. |
||
|---|---|---|
| docs | ||
| verification | ||
| .gitignore | ||
| ATTESTATION-RUNBOOK.md | ||
| KNOWN-GAPS.md | ||
| README.md | ||
| RESPONSE-TO-REVIEWERS.md | ||
| STATEMENT-MAP.md | ||
ltl-accumulator-verified
Lean 4 mechanization of the security analysis (§6) of the system
report "The Lean Transparency Log" (archived at
https://ltl.zkdefi.org/paper/v0.2 — the version this corpus was built
against; the current paper, "Accountable Distribution of Machine-Checked
Correctness Evidence" at https://ltl.zkdefi.org/paper, presents these
results in its §5 and carries this corpus as entry 13): the Merkle
accumulator's own correctness and soundness theorems, kernel-checked, in
the same discipline as the four *-ed25519-verified subject corpora.
Status: ATTESTED — LTL entry 13, live (2026-07-16)
This corpus is now itself a leaf of the log it describes. It was appended
as entry 13 of the Lean Transparency Log (freeze 172a1d0), so the
log carries kernel-checked proofs about the accumulator model
underlying its own inclusion and consistency reasoning (a deployment we
are unaware of a precedent for; scoped to the mechanized model, not the
deployed verifier — see below). Live head after the append:
tree size 13, root
3488a2d0ff9f00415bb561d61b01a420e3ca2e0f7b29351ec9ebb3f57319da0d; this
corpus is leaf index 12, hash
8cb258d657f1fd00baaa9e0091e26c316cb69b591cb249a9543f51cade57c50a. The
old 12-leaf head (bcd15f9d…) is a proven prefix; the 12→13 consistency
transition is accepted by both the deployed verifier and the mechanized
model. Fetch and verify it at
ltl.zkdefi.org/v1/sth. The leaf carries
its own scope block: what is kernel-checked is the mechanized model
(§6), and correspondence to the deployed verifier is scoped by
KNOWN-GAPS 14/15 — the leaf does not claim the deployed verifier is
formally verified.
All paper-§6/§10 mechanization targets (v0.2 numbering) are
kernel-checked; the audit
surface is defined and green (verification/check.sh, exit 0). See
STATEMENT-MAP.md for the paper↔Lean review surface and
KNOWN-GAPS.md for the honest scope ledger.
Reviewed across six external adversarial rounds (GPT-5.6 + a second
Claude; zero broken theorems in any round; both approved). The audit
surface is an environment-derived inventory (Proofs/Inventory.lean +
pinned allowlist — 222 constants, 61 human-reviewed cones, self-tested by
selftest_audit.sh); the review kit is push-button reproducible
(run_bare.sh, self-contained fidelity target);
acceptIncl/acceptCons_sound route the theorems through the named
acceptance predicates; fidelity = agreement over pinned families
(230,271 + 230,016 baseline; 73,573 lied-size boundary cases with
3,867 expected one-sided divergences — KNOWN-GAPS gaps 14/15, not
extensional equality). Doc counts are asserted by check.sh Phase 3c.
How the append was done — release tuple, preflight, candidate-inspection
gate, and the 12→13 structural rehearsal — is recorded in
ATTESTATION-RUNBOOK.md.
| layer | content | status |
|---|---|---|
| L1 | bytes, hleaf/hnode, domain separation (Lemma 1) | done (domsep: axiom-free) |
| L2 | MTH, Root, ConsRec definitions + termination | done (cones: propext, LTLAcc.sha256, Quot.sound) |
| L3 | inclusion completeness (Theorem 1) + named acceptance acceptIncl |
done (incl_complete: propext, Classical.choice, LTLAcc.sha256, Quot.sound) |
| L4 | frontier binding content (Lemma 2) | done as specializations — inlined in the extractor walk (extractIncl), whole-tree (extractMTH), ConsRec (consRecBinding); the standalone Root receipt-uniqueness instance was deleted with the vacuous root_binding in S3.5 and deliberately NOT restored (optional, unused — KNOWN-GAPS gap 3) |
| L5 | inclusion soundness = EXPLICIT extractor extractIncl (Theorem 2) |
done, non-vacuous |
| L6a | descent extractor extractMTH (Theorem 3 step 3 = Lemma 2, whole-tree instance) |
done, non-vacuous |
| L6b | Theorem 3 (consistency soundness): consRecBinding (steps 1–2) + extractCons/extractCons_correct (+ _paper at the paper's exact quantifiers; acceptCons_sound routes it through the named acceptCons predicate, size bound derived from acceptance via consRec_some_le) |
done, non-vacuous |
| L6c | pin-store state machine safety (Proposition 1): pinAccept_monotone, pin_prefix_correct, fork_distinct |
done, non-vacuous (per-step; multi-step chain = gap 7) |
Discipline (identical to the subject corpora)
verification/Proofs/contains ZEROaxiomdeclarations; the single sanctioned axiom site isverification/gen/— here, one opaque function: SHA-256. The theorems are constructive collision extractors, so collision resistance is never assumed, only interpreted.verification/check.shis THE button: compiles every file throughlean-guard(memory cap, core pinning, timeout, single-flight lock) and axiom-audits every certificate against its documented exact cone.- Reviewers without the operator toolchain:
verification/run_bare.shcompiles, axiom-audits, and inventory-gates the corpus with a plain publiclean(version pinned inverification/lean-toolchain); the operator path is overridable viaAENEAS_ENV. - Expected boundary:
propext, Classical.choice, Quot.soundplusLTLAcc.sha256for hash-touching certificates — documented per certificate incheck.sh, audited both directions.
The finished certificates are destined for the LTL itself as attestation leaves: the log carrying kernel-checked proofs of its own machinery.