proof-aware-crypto-tooling-.../src/pacta/config.py

79 lines
2.9 KiB
Python
Raw Normal View History

2026-07-03 08:51:03 +00:00
from __future__ import annotations
from dataclasses import dataclass, field
from pathlib import Path
from typing import Any
from .yamlio import load_data
STANDARD_LEAN_AXIOMS = ["propext", "Classical.choice", "Quot.sound"]
@dataclass(slots=True)
class RepoConfig:
name: str
url: str | None = None
kind: str = "unknown"
verification_dir: str = "verification"
verified_backend: str | None = None
backend_warning: str | None = None
known_status: str | None = None
certificates: list[str] = field(default_factory=list)
expected_axioms: list[str] = field(default_factory=lambda: STANDARD_LEAN_AXIOMS.copy())
known_exclusions: list[str] = field(default_factory=list)
axiom_imports: list[str] = field(default_factory=list)
Estate sync: boundary-axiom vocabulary + the four-tier apex reality (R4) The verified corpus completed its phase 2 on 2026-07-06: every ed25519 fork now carries FOUR button-enforced apex tiers up to the full lift (accept <=> decompress(R) = [k](-A)+[s]B as points), the complete scalar layer, and the constructive encoding/decoding chain. pacta was calibrated to the pre-apex corpus and - worse - had no vocabulary for boundary-audited certificates: its axiom audit knew only "clean = exactly the three standard axioms", so the apex tiers would have scored dirty. New vocabulary: - Profile.certificate_axioms: per-certificate ALLOWED axiom sets; expected_axioms_for(cert) resolves each certificate's own boundary. - RepoConfig.apex_boundary: a simple per-fork key (dalek-wrappers / hash3 / anza) expanded by the ed25519 profile into the exact per-tier allowed sets. AUTHORITY NOTE in profiles/ed25519.py: each repo's check.sh Phase 3b is the enforcement point; if the button and this table disagree, the button wins. - run_axiom_audit compares each certificate against ITS allowed set; deviation in EITHER direction (extra axiom or missing boundary axiom) is dirty. New risk reality: - R4 is now reachable: full four-tier apex + constructive chain + scalar arithmetic, all proven with cones pinned to their documented boundaries. R4 always carries explicit residual blockers (SHA-512 oracle, hypothesis-parametric wire parses, translation faithfulness, no side-channel/build assurance - those gate R5). - R3 unchanged (arithmetic pair) and now explains exactly which apex certificates are missing for R4. Attestation trust model hardened: - The provider is trusted for its OBSERVATION, never its VERDICT: axiom_status is re-derived locally from observed_axioms against the agent's own boundary policy. A provider that labels a dirty cone "clean" gains nothing; "proven" with no observed axioms is "unverifiable". - Partial attestations degrade instead of being rejected: uncovered certificates stay unproven and the score caps accordingly (an arithmetic-only attestation still authorizes an R3 library capsule, never a wallet). Also: scripts/mini_pytest.py - a dependency-free test runner (tmp_path, raises, monkeypatch, capsys) for hosts without pytest; examples regenerated FROM the tool (dalek/anza fixtures now R4, 16 certs; new full four-tier attestation example); tests updated + new tests/test_boundaries.py (lying-provider, missing-boundary-axiom, partial-coverage cases). 40/40 tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 08:04:43 +00:00
apex_boundary: str | None = None
certificate_axioms: dict[str, list[str]] = field(default_factory=dict)
env_script: str | None = None
lean_project_dir: str | None = None
lean_guard: str | None = None
2026-07-03 08:51:03 +00:00
@classmethod
def from_dict(cls, raw: dict[str, Any]) -> "RepoConfig":
if "name" not in raw:
raise ValueError("Repo config is missing required field 'name'")
return cls(
name=str(raw["name"]),
url=raw.get("url"),
kind=str(raw.get("kind", "unknown")),
verification_dir=str(raw.get("verification_dir", "verification")),
verified_backend=raw.get("verified_backend"),
backend_warning=raw.get("backend_warning"),
known_status=raw.get("known_status"),
certificates=list(raw.get("certificates") or []),
expected_axioms=list(raw.get("expected_axioms") or STANDARD_LEAN_AXIOMS),
known_exclusions=list(raw.get("known_exclusions") or []),
axiom_imports=list(raw.get("axiom_imports") or []),
Estate sync: boundary-axiom vocabulary + the four-tier apex reality (R4) The verified corpus completed its phase 2 on 2026-07-06: every ed25519 fork now carries FOUR button-enforced apex tiers up to the full lift (accept <=> decompress(R) = [k](-A)+[s]B as points), the complete scalar layer, and the constructive encoding/decoding chain. pacta was calibrated to the pre-apex corpus and - worse - had no vocabulary for boundary-audited certificates: its axiom audit knew only "clean = exactly the three standard axioms", so the apex tiers would have scored dirty. New vocabulary: - Profile.certificate_axioms: per-certificate ALLOWED axiom sets; expected_axioms_for(cert) resolves each certificate's own boundary. - RepoConfig.apex_boundary: a simple per-fork key (dalek-wrappers / hash3 / anza) expanded by the ed25519 profile into the exact per-tier allowed sets. AUTHORITY NOTE in profiles/ed25519.py: each repo's check.sh Phase 3b is the enforcement point; if the button and this table disagree, the button wins. - run_axiom_audit compares each certificate against ITS allowed set; deviation in EITHER direction (extra axiom or missing boundary axiom) is dirty. New risk reality: - R4 is now reachable: full four-tier apex + constructive chain + scalar arithmetic, all proven with cones pinned to their documented boundaries. R4 always carries explicit residual blockers (SHA-512 oracle, hypothesis-parametric wire parses, translation faithfulness, no side-channel/build assurance - those gate R5). - R3 unchanged (arithmetic pair) and now explains exactly which apex certificates are missing for R4. Attestation trust model hardened: - The provider is trusted for its OBSERVATION, never its VERDICT: axiom_status is re-derived locally from observed_axioms against the agent's own boundary policy. A provider that labels a dirty cone "clean" gains nothing; "proven" with no observed axioms is "unverifiable". - Partial attestations degrade instead of being rejected: uncovered certificates stay unproven and the score caps accordingly (an arithmetic-only attestation still authorizes an R3 library capsule, never a wallet). Also: scripts/mini_pytest.py - a dependency-free test runner (tmp_path, raises, monkeypatch, capsys) for hosts without pytest; examples regenerated FROM the tool (dalek/anza fixtures now R4, 16 certs; new full four-tier attestation example); tests updated + new tests/test_boundaries.py (lying-provider, missing-boundary-axiom, partial-coverage cases). 40/40 tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 08:04:43 +00:00
apex_boundary=raw.get("apex_boundary"),
certificate_axioms={
str(name): [str(a) for a in axioms]
for name, axioms in (raw.get("certificate_axioms") or {}).items()
},
env_script=raw.get("env_script"),
lean_project_dir=raw.get("lean_project_dir"),
lean_guard=raw.get("lean_guard"),
2026-07-03 08:51:03 +00:00
)
@dataclass(slots=True)
class AppConfig:
repos: list[RepoConfig]
def repo_named(self, name: str) -> RepoConfig:
for repo in self.repos:
if repo.name == name:
return repo
available = ", ".join(repo.name for repo in self.repos)
raise KeyError(f"Unknown repo '{name}'. Available: {available}")
def load_config(path: str | Path) -> AppConfig:
raw = load_data(path)
if not isinstance(raw, dict) or "repos" not in raw:
raise ValueError(f"{path} must contain a top-level 'repos' list")
repos = raw["repos"]
if not isinstance(repos, list):
raise ValueError("'repos' must be a list")
return AppConfig(repos=[RepoConfig.from_dict(item) for item in repos])