mrwulf e270872a27 S3.5: explicit collision extractor — Theorem 2 made non-vacuous, vacuous forms removed ...

The S3 Socratic re-audit found incl_sound was kernel-perfect but VACUOUS:
its '... ∨ HasCollision' disjunct (∃ x y, x≠y ∧ sha256 x = sha256 y) is
provable by pigeonhole ALONE (sha256: infinite List UInt8 → finite
32-byte Hash), so the theorem said nothing about forgeries. Even a
data-carrying {p // IsCollision p} disjunct fails (Classical.choice
inhabits it). The only faithful rendering of the paper's 'explicit
algorithm 𝓔' is a NAMED FUNCTION whose correctness is a claim about ITS
OUTPUT.

- extractIncl (m D d P): total function that walks the honest tree and
  returns the concrete colliding preimage pair at the first divergence
  (a node preimage pair, or the leaf preimage pair at the bottom).
- extractIncl_correct: d ≠ D[m] ∧ accepting-receipt →
  IsCollision (extractIncl …).1 (extractIncl …).2. A statement ABOUT the
  fixed function's output; pigeonhole cannot discharge it.
  ADVERSARIAL CHECK (probe, since removed): proved
  ¬ IsCollision (extractIncl 0 [[7]] [7] []) — i.e. on a NON-forgery input
  the output is provably NOT a collision, so the conclusion is genuinely
  false for some inputs ⇒ non-vacuous, choice-proof.
- Removed the vacuous theorems entirely (incl_sound, root_binding,
  hnode/hleaf_inj_or_collision, HasCollision def) so no hollow statement
  survives in a corpus destined for the log. Kept the real building
  blocks (hnode_preimage_inj [propext]; eq_dropLast helper moved to
  Completeness; Binding.lean deleted).

extractIncl_correct cone [propext, Classical.choice, LTLAcc.sha256,
Quot.sound]. THE button green (14 certs). Fable statement-audit passed.
LTL untouched (12 leaves, bcd15f9d).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-11 15:31:21 +02:00

2.2 KiB

Raw History

View raw