saymrwulf/ltl-accumulator-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/ltl-accumulator-verified.git synced 2026-09-03 19:53:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
ltl-accumulator-verified/verification/inventory-allowlist.txt
mrwulf 2da0a79981 Review round 4: F1* absorbed (lied-size boundary), acceptCons_sound, kit reproducibility 
Round-3 verdicts: GPT-5.6 conditionally approves (blockers closed, one
portability finding); the Claude reviewer's Socratic addendum produced
F1*, the strongest finding of the series — deployed verify_consistency
and mechanized ConsRec are NOT extensionally equal. Reproduced exactly
(witness verify_consistency(1,3,R2,R3,P(2→3))=True vs ConsRec reject;
3,405 divergences n<60; strictly one-sided; power-of-two seeding
mechanism confirmed in source).

- KNOWN-GAPS gap 14: witness, mechanism, one-sidedness, and the
  pinned-pair side condition under which Theorem 3 transfers to the
  deployed verifier (pacta's pin-store flow supplies it by
  construction). No pacta code change; deployed behavior matches
  upstream RFC 9162 implementations.
- fidelity: lied-size family — 73,573 boundary cases, 3,867 expected
  divergences PINNED, one-sided direction asserted per case. Banner
  rescoped: agreement over pinned families, not extensional equality.
- Theorem3.lean: acceptCons_sound (F2) — soundness over the named
  acceptCons predicate, n₀=0 discharged from the non-prefix premise,
  size bound derived from acceptance via new consRec_some_le. Cones
  read from #print axioms; CONES/AxiomCheck/allowlist updated
  (218 → 222 constants, diff = the two theorems + two generated
  auxiliaries).
- F3/GPT§7: verification/lean-toolchain pin + run_bare.sh (reviewer's
  standalone runner, plain public lean — verified green: 61 cones, 222
  constants, gate green) + AENEAS_ENV override in check.sh and
  selftest_audit.sh.
- F4: awk field-equality replaces regex-with-dots in Phase 3b.
- F5: git-tracked .pyc removed (worse than reported — it was in the
  repo, not just the kit); __pycache__ gitignored; round-4 kit ships a
  corpus MANIFEST.sha256 + pinned commit (also GPT's governance
  condition).

check.sh exit 0, ATTESTATION GREEN; selftest exit 0, 9/9 + control.
Live LTL untouched (12 leaves, bcd15f9d…); attestation still gated on
ePrint decision + author review + explicit operator order.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-12 15:07:57 +02:00

239 lines
15 KiB
Text
Raw Blame History

# inventory-allowlist.txt — the pinned audit surface (Phase 3b).
#
# One line per constant in the compiled environment of the corpus
# modules (GEN_MODULES + PROOFS in check.sh), emitted by
# Proofs/Inventory.lean: INV|<fully-qualified name>|<kind>|<axiom cone>
#
# EVERYTHING the kernel saw is here — including compiler-generated
# auxiliaries (match_*/eq_*/induct/_proof_*/_unary and _private.*
# mangles). There is no filtering, so there is no name shape that can
# escape: a new, renamed, re-namespaced, private, attributed, indented,
# or instance declaration changes the environment and fails the diff.
# Regenerate ONLY by reviewing `lean-guard Proofs/Inventory.lean` output
# line by line; every addition must be justified in STATEMENT-MAP.md or
# be a compiler-generated auxiliary of a justified declaration.
#
# Invariant checked by check.sh on top of the diff:
# exactly ONE axiom line in this file, and it is LTLAcc.sha256.
INV|LTLAcc.Bytes|def|
INV|LTLAcc.ConsRec._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.ConsRec._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.ConsRec._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec._unary.induct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec.induct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.ConsRec.match_1|def|
INV|LTLAcc.ConsRec|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Hash|def|
INV|LTLAcc.IsCollision|def|LTLAcc.sha256
INV|LTLAcc.MTH._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.MTH._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.MTH.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.MTH.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.MTH_single|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.MTH_split._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.MTH_split._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.MTH_split|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.MTH|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.Path._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.Path._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path._unary.induct|theorem|Quot.sound,propext
INV|LTLAcc.Path._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Path.induct|theorem|Quot.sound,propext
INV|LTLAcc.Path|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.Root._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.Root._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root.match_1|def|
INV|LTLAcc.Root_left._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.Root_left._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.Root_left|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root_one_cons|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root_one|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root_right._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.Root_right._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.Root_right|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.Root|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptCons_sound._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.acceptCons_sound|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptCons|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptIncl_complete|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptIncl_sound|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.acceptIncl|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_10|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_11|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_12|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_13|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_14|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_15|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_16|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_17|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_6|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_7|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding._proof_1_8|theorem|Quot.sound,propext
INV|LTLAcc.consRecBinding.match_1|def|
INV|LTLAcc.consRecBinding|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.consRec_base_false_eq._sparseCasesOn_1|def|propext
INV|LTLAcc.consRec_base_false_eq._sparseCasesOn_2|def|propext
INV|LTLAcc.consRec_base_false_eq.match_1|def|propext
INV|LTLAcc.consRec_base_false_eq|theorem|Classical.choice,Quot.sound,propext
INV|LTLAcc.consRec_base_true_eq.match_1|def|propext
INV|LTLAcc.consRec_base_true_eq|theorem|propext
INV|LTLAcc.consRec_some_le._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.consRec_some_le|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.domsep|theorem|
INV|LTLAcc.eq_dropLast_append_of_getLast?|theorem|propext
INV|LTLAcc.exists_singleton_of_length_one|theorem|Classical.choice,Quot.sound,propext
INV|LTLAcc.extractCons.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons.match_1|def|
INV|LTLAcc.extractConsNode._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.extractConsNode._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.extractConsNode._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractConsNode._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractConsNode.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractConsNode.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractConsNode.match_1|def|
INV|LTLAcc.extractConsNode|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons_correct._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.extractCons_correct._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.extractCons_correct_paper._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.extractCons_correct_paper|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons_correct|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons_nonvacuous._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.extractCons_nonvacuous|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractCons|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl.match_1|def|
INV|LTLAcc.extractIncl_correct._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_6|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_7|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_8|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct._proof_1_9|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_correct|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl_nonvacuous._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.extractIncl_nonvacuous|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractIncl|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH._unary._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH._unary._proof_2|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH._unary.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH._unary.induct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH._unary|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH.eq_def|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH.induct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_10|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_6|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_7|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_8|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct._proof_1_9|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_correct|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH_nonvacuous._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.extractMTH_nonvacuous|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.extractMTH|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.fork_distinct|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.getD_drop._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.getD_drop|theorem|Quot.sound,propext
INV|LTLAcc.getD_take._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.getD_take._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.getD_take|theorem|Quot.sound,propext
INV|LTLAcc.hleaf|def|LTLAcc.sha256
INV|LTLAcc.hnode_preimage_inj|theorem|propext
INV|LTLAcc.hnode|def|LTLAcc.sha256
INV|LTLAcc.incl_complete._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_6|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_7|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_8|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete._proof_1_9|theorem|Quot.sound,propext
INV|LTLAcc.incl_complete|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.instDecidableEqHash._proof_1|theorem|
INV|LTLAcc.instDecidableEqHash|def|
INV|LTLAcc.instInhabitedHash._proof_1|theorem|propext
INV|LTLAcc.instInhabitedHash|def|propext
INV|LTLAcc.kbelow._proof_1|theorem|Quot.sound,propext
INV|LTLAcc.kbelow._unsafe_rec|def|
INV|LTLAcc.kbelow.eq_1|theorem|Quot.sound,propext
INV|LTLAcc.kbelow.eq_def|theorem|Quot.sound,propext
INV|LTLAcc.kbelow.induct|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_eq_of_pow2_between|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_lt._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_lt._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_lt._proof_1_5|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_lt|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_pos|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_pow2|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_prefix_eq._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.kbelow_prefix_eq|theorem|Quot.sound,propext
INV|LTLAcc.kbelow|def|Quot.sound,propext
INV|LTLAcc.le_two_kbelow._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.le_two_kbelow._proof_1_4|theorem|Quot.sound,propext
INV|LTLAcc.le_two_kbelow|theorem|Quot.sound,propext
INV|LTLAcc.pinAccept_monotone._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.pinAccept_monotone._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.pinAccept_monotone|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pinAccept|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pinExtract.eq_1|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pinExtract|def|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pin_prefix_correct._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.pin_prefix_correct|theorem|Classical.choice,LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pin_prefix_nonvacuous._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.pin_prefix_nonvacuous|theorem|LTLAcc.sha256,Quot.sound,propext
INV|LTLAcc.pow2_exp_unique._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.pow2_exp_unique._proof_1_2|theorem|Quot.sound,propext
INV|LTLAcc.pow2_exp_unique._proof_1_3|theorem|Quot.sound,propext
INV|LTLAcc.pow2_exp_unique|theorem|Quot.sound,propext
INV|LTLAcc.sha256|axiom|LTLAcc.sha256
INV|LTLAcc.take_all|theorem|propext
INV|LTLAcc.take_append_drop|theorem|
INV|LTLAcc.take_drop_prefix|theorem|Classical.choice,Quot.sound,propext
INV|LTLAcc.take_take_le._proof_1_1|theorem|Quot.sound,propext
INV|LTLAcc.take_take_le|theorem|Quot.sound,propext
INV|_private.Proofs.Basic.0.LTLAcc.ConsRec.match_1.eq_1|theorem|
INV|_private.Proofs.Basic.0.LTLAcc.ConsRec.match_1.eq_2|theorem|
INV|_private.Proofs.Basic.0.LTLAcc.ConsRec.match_1.splitter|def|
INV|_private.Proofs.Basic.0.LTLAcc.Root.match_1.eq_1|theorem|
INV|_private.Proofs.Basic.0.LTLAcc.Root.match_1.eq_2|theorem|
INV|_private.Proofs.Basic.0.LTLAcc.Root.match_1.splitter|def|
INV|_private.Proofs.Basic.0.PSigma.casesOn._arg_pusher|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.ConsRec.match_1.eq_1|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.ConsRec.match_1.eq_2|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.ConsRec.match_1.splitter|def|
INV|_private.Proofs.Binding3.0.LTLAcc.Root.match_1.eq_1|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.Root.match_1.eq_2|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.Root.match_1.splitter|def|
INV|_private.Proofs.Binding3.0.LTLAcc.consRecBinding.match_1.eq_1|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.consRecBinding.match_1.eq_2|theorem|
INV|_private.Proofs.Binding3.0.LTLAcc.consRecBinding.match_1.splitter|def|
INV|_private.Proofs.Completeness.0.PSigma.casesOn._arg_pusher|theorem|
INV|_private.Proofs.Consistency.0.LTLAcc.extractConsNode.match_1.eq_1|theorem|
INV|_private.Proofs.Consistency.0.LTLAcc.extractConsNode.match_1.eq_2|theorem|
INV|_private.Proofs.Consistency.0.LTLAcc.extractConsNode.match_1.splitter|def|
INV|_private.Proofs.Consistency.0.PSigma.casesOn._arg_pusher|theorem|
INV|_private.Proofs.Descent.0.PSigma.casesOn._arg_pusher|theorem|
INV|_private.Proofs.Extract.0.LTLAcc.extractIncl.match_1.eq_1|theorem|
INV|_private.Proofs.Extract.0.LTLAcc.extractIncl.match_1.eq_2|theorem|
INV|_private.Proofs.Extract.0.LTLAcc.extractIncl.match_1.splitter|def|
INV|_private.Proofs.Extract.0.PSigma.casesOn._arg_pusher|theorem|
Reference in a new issue View git blame Copy permalink