mirror of https://github.com/saymrwulf/ltl-accumulator-verified.git synced 2026-09-03 19:53:48 +00:00

No description

Find a file

mrwulf e270872a27 S3.5: explicit collision extractor — Theorem 2 made non-vacuous, vacuous forms removed The S3 Socratic re-audit found incl_sound was kernel-perfect but VACUOUS: its '... ∨ HasCollision' disjunct (∃ x y, x≠y ∧ sha256 x = sha256 y) is provable by pigeonhole ALONE (sha256: infinite List UInt8 → finite 32-byte Hash), so the theorem said nothing about forgeries. Even a data-carrying {p // IsCollision p} disjunct fails (Classical.choice inhabits it). The only faithful rendering of the paper's 'explicit algorithm 𝓔' is a NAMED FUNCTION whose correctness is a claim about ITS OUTPUT. - extractIncl (m D d P): total function that walks the honest tree and returns the concrete colliding preimage pair at the first divergence (a node preimage pair, or the leaf preimage pair at the bottom). - extractIncl_correct: d ≠ D[m] ∧ accepting-receipt → IsCollision (extractIncl …).1 (extractIncl …).2. A statement ABOUT the fixed function's output; pigeonhole cannot discharge it. ADVERSARIAL CHECK (probe, since removed): proved ¬ IsCollision (extractIncl 0 [[7]] [7] []) — i.e. on a NON-forgery input the output is provably NOT a collision, so the conclusion is genuinely false for some inputs ⇒ non-vacuous, choice-proof. - Removed the vacuous theorems entirely (incl_sound, root_binding, hnode/hleaf_inj_or_collision, HasCollision def) so no hollow statement survives in a corpus destined for the log. Kept the real building blocks (hnode_preimage_inj [propext]; eq_dropLast helper moved to Completeness; Binding.lean deleted). extractIncl_correct cone [propext, Classical.choice, LTLAcc.sha256, Quot.sound]. THE button green (14 certs). Fable statement-audit passed. LTL untouched (12 leaves, bcd15f9d). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-11 15:31:21 +02:00
verification	S3.5: explicit collision extractor — Theorem 2 made non-vacuous, vacuous forms removed	2026-07-11 15:31:21 +02:00
README.md	S3.5: explicit collision extractor — Theorem 2 made non-vacuous, vacuous forms removed	2026-07-11 15:31:21 +02:00

mrwulf e270872a27 S3.5: explicit collision extractor — Theorem 2 made non-vacuous, vacuous forms removed

The S3 Socratic re-audit found incl_sound was kernel-perfect but VACUOUS:
its '... ∨ HasCollision' disjunct (∃ x y, x≠y ∧ sha256 x = sha256 y) is
provable by pigeonhole ALONE (sha256: infinite List UInt8 → finite
32-byte Hash), so the theorem said nothing about forgeries. Even a
data-carrying {p // IsCollision p} disjunct fails (Classical.choice
inhabits it). The only faithful rendering of the paper's 'explicit
algorithm 𝓔' is a NAMED FUNCTION whose correctness is a claim about ITS
OUTPUT.

- extractIncl (m D d P): total function that walks the honest tree and
  returns the concrete colliding preimage pair at the first divergence
  (a node preimage pair, or the leaf preimage pair at the bottom).
- extractIncl_correct: d ≠ D[m] ∧ accepting-receipt →
  IsCollision (extractIncl …).1 (extractIncl …).2. A statement ABOUT the
  fixed function's output; pigeonhole cannot discharge it.
  ADVERSARIAL CHECK (probe, since removed): proved
  ¬ IsCollision (extractIncl 0 [[7]] [7] []) — i.e. on a NON-forgery input
  the output is provably NOT a collision, so the conclusion is genuinely
  false for some inputs ⇒ non-vacuous, choice-proof.
- Removed the vacuous theorems entirely (incl_sound, root_binding,
  hnode/hleaf_inj_or_collision, HasCollision def) so no hollow statement
  survives in a corpus destined for the log. Kept the real building
  blocks (hnode_preimage_inj [propext]; eq_dropLast helper moved to
  Completeness; Binding.lean deleted).

extractIncl_correct cone [propext, Classical.choice, LTLAcc.sha256,
Quot.sound]. THE button green (14 certs). Fable statement-audit passed.
LTL untouched (12 leaves, bcd15f9d).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-11 15:31:21 +02:00

verification

S3.5: explicit collision extractor — Theorem 2 made non-vacuous, vacuous forms removed

2026-07-11 15:31:21 +02:00

README.md

S3.5: explicit collision extractor — Theorem 2 made non-vacuous, vacuous forms removed

2026-07-11 15:31:21 +02:00

README.md

ltl-accumulator-verified

Lean 4 mechanization of the security analysis (§6) of the paper "The Lean Transparency Log" (https://ltl.zkdefi.org/paper): the Merkle accumulator's own correctness and soundness theorems, kernel-checked, in the same discipline as the four *-ed25519-verified subject corpora.

Status: layer scaffold (work in progress — honest ledger below)

layer	content	status
L1	bytes, hleaf/hnode, domain separation (Lemma 1)	done (domsep: axiom-free)
L2	MTH, Root, ConsRec definitions + termination	done (cones: propext, LTLAcc.sha256, Quot.sound)
L3	inclusion completeness (Theorem 1)	done (incl_complete: propext, Classical.choice, LTLAcc.sha256, Quot.sound)
L4	root binding for inclusion (Lemma 2, Path instance)	done (root_binding; boundary = single sha256 axiom)
L5	inclusion soundness = EXPLICIT collision extractor extractIncl+correctness (Theorem 2) done, non-vacuous; consistency (Theorem 3) pending
L6	pin-store state machine safety (Proposition 1)	pending

Discipline (identical to the subject corpora)

verification/Proofs/ contains ZERO axiom declarations; the single sanctioned axiom site is verification/gen/ — here, one opaque function: SHA-256. The theorems are constructive collision extractors, so collision resistance is never assumed, only interpreted.
verification/check.sh is THE button: compiles every file through lean-guard (memory cap, core pinning, timeout, single-flight lock) and axiom-audits every certificate against its documented exact cone.
Expected boundary: propext, Classical.choice, Quot.sound plus LTLAcc.sha256 for hash-touching certificates — documented per certificate in check.sh, audited both directions.

The finished certificates are destined for the LTL itself as attestation leaves: the log carrying kernel-checked proofs of its own machinery.