mirror of
https://github.com/saymrwulf/proof-aware-crypto-tooling-agent.git
synced 2026-09-04 20:03:40 +00:00
mrwulf
6cf1694453
Review A (second Fable instance, delivered via USB, findings re-verified by me against the tex before adoption; its frontier lemma re-derived from scratch before applying): - THE REAL FIX: Lemma 2's hash-fold definition did not cover its own two uses (Root recomputes only along the leaf's root path; ConsRec bottoms out at the [0,n0) decomposition and consumes the pinned root, which the old Steps 1-2 never pinned - incl. the degenerate case where the first component IS the pinned root alone). Now: folds shaped by a connected sub-tree S containing the root, children outside S consumed as opaque inputs, conclusion pins emitted values AND all consumed inputs; Thm 2 names its S; Thm 3 pins the consumed anchor and handles the degenerate case; Lemma 1's role stated honestly. - dangling R4/R5 taxonomy labels removed; G3/Prop 2 statements now match their own veto-proof (deny-only, everywhere); Table 1 caption counts boundary+standard-three; r1 defined as raw signature bytes (T1's whole point); Contribution 4 'embedded in every signature' -> 'published alongside'; Figure 1 redrawn in the exact RFC 9162 shape for n=12; Solana error-type nit; App D namespace elision noted. Review B (GPT-5.6, positions defended 2026-07-10, concessions adopted): - abstract + G2 narrowed to what Prop 1 proves (same-size evidence + monotonicity), unequal-size split views routed through the public leaf mirror; residual-trust sentence stated at honest width (checkout, deps, binding, parsing in the trusted observation pipeline); freshness declared an availability policy (freeze attacks not prevented); self-reference verb 'ensures' -> 'enforces and records' + signature reveals nothing about the producing program; novelty softened to 'we are unaware of'; 25-line/150-line accounting in one breath; missing-oracle-axiom = refuse-to-classify drift (keeping the oracle argument); mechanization tone softened; head-encoding reality documented (versioned canonical JSON w/ log id - system was ahead of the paper); NEW claim-matrix table (Table 2) decomposing every consumer conclusion into mechanism + residual assumption, incl. two deliberate not-established rows. Open questions from Review A resolved: black_box 27 lines are per-lemma trusted-base bookkeeping (no published cone contains black_box - verified); T4 x=0 edge case now stated precisely (roots coincide, set sign bit rejected per RFC 8032, covered by the iff over extracted code; Lean sqrt_core handles x=0 explicitly); Cheval pages (DBLP-verified) restored alongside Review A's DOI. 18 pages, 106 tests green, accumulator untouched (12 leaves). webdocs/llms.txt page counts updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
37 lines
2.1 KiB
Text
37 lines
2.1 KiB
Text
# pacta — proof-aware crypto tooling agent
|
||
|
||
> Tooling for autonomous agents that must choose, and then run on, a
|
||
> cryptographic library they can trust with money. Evidence of formal
|
||
> verification is turned into machine-readable claim cards, scored R0–R5,
|
||
> with every verdict re-derived locally from observed Lean axiom cones —
|
||
> never taken on a provider's word. The `warden` product builds a custody
|
||
> wallet whose Ed25519 boundary is a quorum of four independently proven
|
||
> curve25519-dalek forks.
|
||
|
||
## Start here
|
||
|
||
- [README.md](README.md): what pacta is, the R0–R5 risk model, the dogfood loop.
|
||
- [WALLET.md](WALLET.md): warden, the verified-custody wallet — the quorum boundary, the signing firewall, the R4 gate, the MCP surface.
|
||
- [docs/agent-native.md](docs/agent-native.md): why the wallet is agent-native first (AX, MCP, A2A, AP2, x402, ERC-8004) and what each idea became.
|
||
- [docs/products.md](docs/products.md): the four warden deployment profiles.
|
||
|
||
## Live evidence
|
||
|
||
- Transparency log (RFC 9162): https://ltl.zkdefi.org — signed replay attestations of the Lean proofs, one leaf per fork.
|
||
- The paper: https://ltl.zkdefi.org/paper — "The Lean Transparency Log: Distributing Kernel-Checked Correctness Evidence for Deployed Ed25519 Implementations" (revised, with security proofs, 18 pages; prior version at /paper/v0.1).
|
||
|
||
## For agents
|
||
|
||
warden speaks MCP over stdio: `pacta wallet mcp --wallet <dir>`. Tools:
|
||
`wallet_status`, `verify_inbound`, `request_signature`, `custody_card`,
|
||
`posture_challenge`, `list_incidents`, `explain_refusal`. Errors are
|
||
structured objects (code / missing / remediation). The custody card at
|
||
`.well-known/custody-card.json` is self-proving: it embeds transparency-log
|
||
inclusion proofs a counterparty recomputes rather than trusts.
|
||
|
||
## Honesty boundary
|
||
|
||
Verification paths are certificate-covered; signing is trusted base (the
|
||
attested artifact, fenced by the firewall). SHA-512 is an opaque oracle;
|
||
wire parsers are hypotheses; reproducible builds and side channels are R5,
|
||
not claimed; ML-DSA (PQC) fails closed — no proven implementation exists.
|