2026-07-03 08:51:03 +00:00
|
|
|
from __future__ import annotations
|
|
|
|
|
|
|
|
|
|
from dataclasses import dataclass, field
|
|
|
|
|
from pathlib import Path
|
|
|
|
|
from typing import Any
|
|
|
|
|
|
|
|
|
|
from .yamlio import load_data
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
STANDARD_LEAN_AXIOMS = ["propext", "Classical.choice", "Quot.sound"]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@dataclass(slots=True)
|
|
|
|
|
class RepoConfig:
|
|
|
|
|
name: str
|
|
|
|
|
url: str | None = None
|
|
|
|
|
kind: str = "unknown"
|
|
|
|
|
verification_dir: str = "verification"
|
|
|
|
|
verified_backend: str | None = None
|
|
|
|
|
backend_warning: str | None = None
|
|
|
|
|
known_status: str | None = None
|
|
|
|
|
certificates: list[str] = field(default_factory=list)
|
|
|
|
|
expected_axioms: list[str] = field(default_factory=lambda: STANDARD_LEAN_AXIOMS.copy())
|
|
|
|
|
known_exclusions: list[str] = field(default_factory=list)
|
|
|
|
|
axiom_imports: list[str] = field(default_factory=list)
|
Estate sync: boundary-axiom vocabulary + the four-tier apex reality (R4)
The verified corpus completed its phase 2 on 2026-07-06: every ed25519
fork now carries FOUR button-enforced apex tiers up to the full lift
(accept <=> decompress(R) = [k](-A)+[s]B as points), the complete scalar
layer, and the constructive encoding/decoding chain. pacta was calibrated
to the pre-apex corpus and - worse - had no vocabulary for
boundary-audited certificates: its axiom audit knew only "clean = exactly
the three standard axioms", so the apex tiers would have scored dirty.
New vocabulary:
- Profile.certificate_axioms: per-certificate ALLOWED axiom sets;
expected_axioms_for(cert) resolves each certificate's own boundary.
- RepoConfig.apex_boundary: a simple per-fork key (dalek-wrappers /
hash3 / anza) expanded by the ed25519 profile into the exact
per-tier allowed sets. AUTHORITY NOTE in profiles/ed25519.py: each
repo's check.sh Phase 3b is the enforcement point; if the button and
this table disagree, the button wins.
- run_axiom_audit compares each certificate against ITS allowed set;
deviation in EITHER direction (extra axiom or missing boundary
axiom) is dirty.
New risk reality:
- R4 is now reachable: full four-tier apex + constructive chain +
scalar arithmetic, all proven with cones pinned to their documented
boundaries. R4 always carries explicit residual blockers (SHA-512
oracle, hypothesis-parametric wire parses, translation faithfulness,
no side-channel/build assurance - those gate R5).
- R3 unchanged (arithmetic pair) and now explains exactly which apex
certificates are missing for R4.
Attestation trust model hardened:
- The provider is trusted for its OBSERVATION, never its VERDICT:
axiom_status is re-derived locally from observed_axioms against the
agent's own boundary policy. A provider that labels a dirty cone
"clean" gains nothing; "proven" with no observed axioms is
"unverifiable".
- Partial attestations degrade instead of being rejected: uncovered
certificates stay unproven and the score caps accordingly (an
arithmetic-only attestation still authorizes an R3 library capsule,
never a wallet).
Also: scripts/mini_pytest.py - a dependency-free test runner (tmp_path,
raises, monkeypatch, capsys) for hosts without pytest; examples
regenerated FROM the tool (dalek/anza fixtures now R4, 16 certs; new
full four-tier attestation example); tests updated + new
tests/test_boundaries.py (lying-provider, missing-boundary-axiom,
partial-coverage cases). 40/40 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 08:04:43 +00:00
|
|
|
apex_boundary: str | None = None
|
|
|
|
|
certificate_axioms: dict[str, list[str]] = field(default_factory=dict)
|
2026-07-03 09:24:13 +00:00
|
|
|
env_script: str | None = None
|
|
|
|
|
lean_project_dir: str | None = None
|
2026-07-03 08:51:03 +00:00
|
|
|
|
|
|
|
|
@classmethod
|
|
|
|
|
def from_dict(cls, raw: dict[str, Any]) -> "RepoConfig":
|
|
|
|
|
if "name" not in raw:
|
|
|
|
|
raise ValueError("Repo config is missing required field 'name'")
|
|
|
|
|
return cls(
|
|
|
|
|
name=str(raw["name"]),
|
|
|
|
|
url=raw.get("url"),
|
|
|
|
|
kind=str(raw.get("kind", "unknown")),
|
|
|
|
|
verification_dir=str(raw.get("verification_dir", "verification")),
|
|
|
|
|
verified_backend=raw.get("verified_backend"),
|
|
|
|
|
backend_warning=raw.get("backend_warning"),
|
|
|
|
|
known_status=raw.get("known_status"),
|
|
|
|
|
certificates=list(raw.get("certificates") or []),
|
|
|
|
|
expected_axioms=list(raw.get("expected_axioms") or STANDARD_LEAN_AXIOMS),
|
|
|
|
|
known_exclusions=list(raw.get("known_exclusions") or []),
|
|
|
|
|
axiom_imports=list(raw.get("axiom_imports") or []),
|
Estate sync: boundary-axiom vocabulary + the four-tier apex reality (R4)
The verified corpus completed its phase 2 on 2026-07-06: every ed25519
fork now carries FOUR button-enforced apex tiers up to the full lift
(accept <=> decompress(R) = [k](-A)+[s]B as points), the complete scalar
layer, and the constructive encoding/decoding chain. pacta was calibrated
to the pre-apex corpus and - worse - had no vocabulary for
boundary-audited certificates: its axiom audit knew only "clean = exactly
the three standard axioms", so the apex tiers would have scored dirty.
New vocabulary:
- Profile.certificate_axioms: per-certificate ALLOWED axiom sets;
expected_axioms_for(cert) resolves each certificate's own boundary.
- RepoConfig.apex_boundary: a simple per-fork key (dalek-wrappers /
hash3 / anza) expanded by the ed25519 profile into the exact
per-tier allowed sets. AUTHORITY NOTE in profiles/ed25519.py: each
repo's check.sh Phase 3b is the enforcement point; if the button and
this table disagree, the button wins.
- run_axiom_audit compares each certificate against ITS allowed set;
deviation in EITHER direction (extra axiom or missing boundary
axiom) is dirty.
New risk reality:
- R4 is now reachable: full four-tier apex + constructive chain +
scalar arithmetic, all proven with cones pinned to their documented
boundaries. R4 always carries explicit residual blockers (SHA-512
oracle, hypothesis-parametric wire parses, translation faithfulness,
no side-channel/build assurance - those gate R5).
- R3 unchanged (arithmetic pair) and now explains exactly which apex
certificates are missing for R4.
Attestation trust model hardened:
- The provider is trusted for its OBSERVATION, never its VERDICT:
axiom_status is re-derived locally from observed_axioms against the
agent's own boundary policy. A provider that labels a dirty cone
"clean" gains nothing; "proven" with no observed axioms is
"unverifiable".
- Partial attestations degrade instead of being rejected: uncovered
certificates stay unproven and the score caps accordingly (an
arithmetic-only attestation still authorizes an R3 library capsule,
never a wallet).
Also: scripts/mini_pytest.py - a dependency-free test runner (tmp_path,
raises, monkeypatch, capsys) for hosts without pytest; examples
regenerated FROM the tool (dalek/anza fixtures now R4, 16 certs; new
full four-tier attestation example); tests updated + new
tests/test_boundaries.py (lying-provider, missing-boundary-axiom,
partial-coverage cases). 40/40 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 08:04:43 +00:00
|
|
|
apex_boundary=raw.get("apex_boundary"),
|
|
|
|
|
certificate_axioms={
|
|
|
|
|
str(name): [str(a) for a in axioms]
|
|
|
|
|
for name, axioms in (raw.get("certificate_axioms") or {}).items()
|
|
|
|
|
},
|
2026-07-03 09:24:13 +00:00
|
|
|
env_script=raw.get("env_script"),
|
|
|
|
|
lean_project_dir=raw.get("lean_project_dir"),
|
2026-07-03 08:51:03 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@dataclass(slots=True)
|
|
|
|
|
class AppConfig:
|
|
|
|
|
repos: list[RepoConfig]
|
|
|
|
|
|
|
|
|
|
def repo_named(self, name: str) -> RepoConfig:
|
|
|
|
|
for repo in self.repos:
|
|
|
|
|
if repo.name == name:
|
|
|
|
|
return repo
|
|
|
|
|
available = ", ".join(repo.name for repo in self.repos)
|
|
|
|
|
raise KeyError(f"Unknown repo '{name}'. Available: {available}")
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def load_config(path: str | Path) -> AppConfig:
|
|
|
|
|
raw = load_data(path)
|
|
|
|
|
if not isinstance(raw, dict) or "repos" not in raw:
|
|
|
|
|
raise ValueError(f"{path} must contain a top-level 'repos' list")
|
|
|
|
|
repos = raw["repos"]
|
|
|
|
|
if not isinstance(repos, list):
|
|
|
|
|
raise ValueError("'repos' must be a list")
|
|
|
|
|
return AppConfig(repos=[RepoConfig.from_dict(item) for item in repos])
|