mirror of
https://github.com/saymrwulf/risc0-ed25519-verified.git
synced 2026-09-04 20:03:41 +00:00
mrwulf
847613eb76
Phase 2b asks the kernel whether any AXIOM is declared under Proofs/. Phase 3
pins the cones of the named certificates. Between them sat every other
declaration in the corpus — around three thousand of them — and a helper lemma
quietly acquiring a hash oracle in its cone moved nothing either phase looked
at.
Phase 2c closes that. Ported from ltl-accumulator-verified, where a nine-attack
self-test proved a source-regex enumerator evadable by attributed, private,
indented and `instance` declarations and by a nested-namespace basename
collision. Reading the compiled environment sees what the kernel saw; no name
shape hides. Every constant contributes module, name, kind and full axiom cone,
and the observed set must equal inventory-allowlist.txt exactly in BOTH
directions, with a count trailer so a truncated run cannot pass as an empty
diff.
FOUR THINGS THIS BUILD GOT WRONG, each caught by a check rather than by review:
- The number of inventory drivers is a per-repo FACT, not an assumption.
dalek and anza cannot import their corpus as one environment (Proofs.Basic
and Proofs.ConstSpecs both declare CurveFieldProofs.zero_spec); risc0 and
betrusted have no Proofs.Basic at all. Determined by compiling a probe.
check.sh now DISCOVERS its drivers from the filesystem instead of naming
two, and the generator refuses to split out a module the repo lacks.
- The split let one real declaration hide behind another's entry. Keyed on
name alone, the two zero_specs produced byte-identical records, so 3022
declarations were covered by 3021 allowlist entries. Caught by the count
trailer. Every record now carries its originating module.
- The gate's success line said "single sanctioned axiom", inherited from the
accumulator's policy. This corpus permits NONE. A success message
describing a different rule is how an assertion stops meaning anything.
- selftest-axgate.sh lifted Phase 2b with a range ending at "Phase 3", so
inserting Phase 2c between them made it swallow the new phase and die on
variables only check.sh defines — surfacing as the BASELINE case failing,
a self-test blaming a gate for its own extraction bug. Both self-tests now
stop at the next phase marker whatever it is called, and refuse to run if
they capture more than one phase. The guard is the fix; the range was the
symptom.
WHAT THIS IS NOT, recorded in TRUSTED-BASE.md at the same length as the claim:
- No independent cone walker. The accumulator cross-checks collectAxioms
against a hand-written walker. Ported here it was wrong in BOTH directions
on mathlib's inductive shapes: EdPoint gave [] against the kernel's three
axioms, and once extended, ProjPoint gave three against the kernel's none.
Two implementations disagreeing both ways are a second wrong answer, not a
check. These cones rest on collectAxioms alone.
- Thirteen Proofs/Scalar* modules are inventoried by nothing — the
second-button seam, still open. Phase 2c names every uncovered module on
every run so the omission is visible rather than inferred.
selftest-inventory.sh exercises the shipping gate with six cases, each
asserting a specific diagnostic, including the one that matters: a cone
widened by one oracle while name, module and kind stay put. Negative-tested by
disabling the gate's diff, which turns two cases red including one for the
wrong reason, correctly reported as such.
Verified green: 20 runs across the four repositories (four buttons, four
harness, four inventory, four axgate, four binding self-tests), zero red. The
four check-scalar.sh greens from the preceding sweep stand: that script neither
reads the pin file nor changed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
64 lines
3.3 KiB
Bash
Executable file
64 lines
3.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# inventory_gate.sh — diff an observed environment inventory against the
|
|
# pinned allowlist. PORTED VERBATIM from ltl-accumulator-verified apart from
|
|
# the axiom-surface assertion, which is repo-specific: there the corpus admits
|
|
# exactly one sanctioned axiom, here it admits none.
|
|
#
|
|
# This is THE production coverage gate: check.sh Phase 2c calls it, and the
|
|
# self-test exercises this exact script — the tested logic IS the shipping
|
|
# logic.
|
|
#
|
|
# Usage: inventory_gate.sh <observed-lean-output> <allowlist-file>
|
|
#
|
|
# Fail-closed in BOTH directions:
|
|
# UNCLASSIFIED — constant in the environment, absent from the allowlist
|
|
# (new/renamed decl, changed kind, or changed axiom cone)
|
|
# STALE — allowlist entry absent from the environment
|
|
# plus an output-integrity check: the INV-COUNT trailer emitted by
|
|
# Proofs/Inventory.lean must equal the number of INV lines actually seen,
|
|
# so a truncated or crashed run can never pass as an empty diff.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -uo pipefail
|
|
export LC_ALL=C # byte-order collation: sort/comm must agree with Lean's String order
|
|
obs_file="$1"; allow_file="$2"
|
|
|
|
OBS=$(grep '^INV|' "$obs_file" | sort -u)
|
|
N_OBS=$(printf '%s' "$OBS" | grep -c '^INV|' || true)
|
|
TRAILER=$(grep '^INV-COUNT|' "$obs_file" | tail -1 | cut -d'|' -f2)
|
|
if [ -z "$TRAILER" ] || [ "$TRAILER" != "$N_OBS" ]; then
|
|
echo " INVENTORY TRUNCATED: trailer=${TRAILER:-absent}, observed $N_OBS lines"
|
|
exit 1
|
|
fi
|
|
|
|
ALLOW=$(grep '^INV|' "$allow_file" | sort -u)
|
|
FAILGATE=0
|
|
UNCLASS=$(comm -23 <(printf '%s\n' "$OBS") <(printf '%s\n' "$ALLOW"))
|
|
STALE=$(comm -13 <(printf '%s\n' "$OBS") <(printf '%s\n' "$ALLOW"))
|
|
if [ -n "$UNCLASS" ]; then
|
|
printf '%s\n' "$UNCLASS" | sed 's/^/ UNCLASSIFIED (in environment, not allowlisted): /'
|
|
FAILGATE=1
|
|
fi
|
|
if [ -n "$STALE" ]; then
|
|
printf '%s\n' "$STALE" | sed 's/^/ STALE (allowlisted, not in environment): /'
|
|
FAILGATE=1
|
|
fi
|
|
|
|
# The audited corpus admits NO axiom declarations at all: the sanctioned
|
|
# external models live in gen/, outside every module these drivers cover, and
|
|
# are byte-pinned by Phase 0b. An axiom appearing here would be a declaration
|
|
# smuggled into the proof corpus, which Phase 2b also catches kernel-side —
|
|
# two independent gates on the same property, deliberately.
|
|
AXLINES=$(printf '%s\n' "$OBS" | grep '|axiom|' || true)
|
|
if [ -n "$AXLINES" ]; then
|
|
echo " AXIOM SURFACE DRIFT: the audited corpus must declare no axioms; observed:"
|
|
printf '%s\n' "$AXLINES" | sed 's/^/ /'
|
|
FAILGATE=1
|
|
fi
|
|
|
|
# The message must describe what was actually checked. It said "single
|
|
# sanctioned axiom" when ported, which is the accumulator's policy; here the
|
|
# audited corpus permits NONE, and a success line describing a different rule
|
|
# is how an assertion quietly stops meaning anything.
|
|
[ "$FAILGATE" = 0 ] && echo " inventory gate: $N_OBS constants, environment == allowlist, zero axioms declared in the audited corpus"
|
|
exit "$FAILGATE"
|